MAL-2026-13354

    Dashboard / Malicious Package / MAL-2026-13354

    MAL-2026-13354

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in web3-utils-crypto (npm)

    Details: Source: amazon-inspector (d1f0dfc7ad97140ef740758424cd859d9c25ee55a6d6346859cebaf1e64cdce9) web3-utils-crypto impersonates the web3-utils library (package description: 'Drop-in replacement for web3-utils') and ships stub wallet APIs including generateMnemonic and createWallet that return non-functional random values. On require(), index.js serializes the full process.env plus os.hostname, username, homedir, platform, cwd, package name/version and timestamp, base64-encodes the payload, and sends it via HTTPS GET to https://api.telegram.org/bot<token>/sendMessage with chat_id 8969499041 (bot id 7231970337). A tmp flag file suppresses repeat sends. process.env on developer and CI machines routinely contains AWS_*, GITHUB_TOKEN, NPM_TOKEN, DB_PASSWORD and similar credentials, so any consumer that installs and loads this package leaks its full environment to the attacker-controlled Telegram chat.

    References: https://www.npmjs.com/package/web3-utils-crypto/v/1.10.4

    Affected packages

    Package

    Name: web3-utils-crypto

    Purl: pkg:npm/web3-utils-crypto

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.10.4
    MAL-2026-13354 | CVE-DB