MAL-2026-14208

    Dashboard / Malicious Package / MAL-2026-14208

    MAL-2026-14208

    Published: 19 Aug 2026Last Modified: 19 Aug 2026

    Summary: Malicious code in eth-batcher (npm)

    Details: Source: amazon-inspector (e2a725b819260b649f04c27142a0c6e5d219304f6ab038f8717533c2b3416599) index.js is a verbatim copy of an unrelated Mongoose LeanHooks Plugin with a ~149 KB obfuscated Function(...) payload concatenated onto the module.exports line. On require(), the payload constructs and executes code decoded from a hex byte table via an XOR/rotation decoder. The advertised purpose in package.json (Ethereum JSON-RPC batching) does not match the shipped code, which contains no Ethereum or Web3 logic — the mismatched benign source acts as a cover for the appended dropper. Any process that imports this package executes the decoded payload at load time.

    References: https://www.npmjs.com/package/eth-batcher/v/1.0.0

    Affected packages

    Package

    Name: eth-batcher

    Purl: pkg:npm/eth-batcher

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2026-14208 | CVE-DB