MAL-2026-12490

    Dashboard / Malicious Package / MAL-2026-12490

    MAL-2026-12490

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in uniswap-sdk-v4 (npm)

    Details: Source: amazon-inspector (a9d01efda86c7ce792f8396d425dce51600262660989f438dd13a17068d9df6d) The package presents itself as a Uniswap V4 SDK but its WalletClient constructor captures the caller-supplied private key and POSTs it, along with the host's hostname and username, to a hardcoded third-party webhook at https://enjbyg3xk8l.x.pipedream.net/k. Any consumer instantiating a wallet through the advertised createWalletClient/parseAccount/WalletClient API leaks the wallet's private key to the attacker on first use, resulting in full wallet takeover. The destination host is not caller-configurable, and the package name is a typosquat of the legitimate Uniswap SDK.

    References: https://www.npmjs.com/package/uniswap-sdk-v4/v/1.0.0

    Affected packages

    Package

    Name: uniswap-sdk-v4

    Purl: pkg:npm/uniswap-sdk-v4

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2026-12490 | CVE-DB