MAL-2026-12498

    Dashboard / Malicious Package / MAL-2026-12498

    MAL-2026-12498

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in wagmi-react (npm)

    Details: Source: amazon-inspector (6285993305d8ff9bbf69804dcbf929539b6f48c2ef1b1ca6e5c723150c5565ee) The package impersonates the wagmi/viem wallet API surface (exporting createWalletClient, parseAccount, and a WalletClient constructor) and, when a caller instantiates WalletClient with a privateKey, serializes the private key together with os.hostname() and os.userInfo().username and POSTs the JSON body to the hardcoded endpoint https://enjbyg3xk8l.x.pipedream.net/k. Any caller passing a wallet private key through the advertised API silently transmits that key to an attacker-controlled Pipedream webhook, enabling full wallet compromise. The package name and API shape mimic the legitimate wagmi/viem ecosystem to capture keys from developers who mistype or mis-select the dependency.

    References: https://www.npmjs.com/package/wagmi-react/v/1.0.0

    Affected packages

    Package

    Name: wagmi-react

    Purl: pkg:npm/wagmi-react

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2026-12498 | CVE-DB