MAL-2026-14300

    Dashboard / Malicious Package / MAL-2026-14300

    MAL-2026-14300

    Published: 19 Aug 2026Last Modified: 19 Aug 2026

    Summary: Malicious code in eth-react-provider (npm)

    Details: Source: amazon-inspector (7b9bdf79a694cbf6d1a840541b4c47fdac8dc6ac32f4b6a3d4887d5f81233387) The package advertises itself as a React Ethereum provider exporting EthereumProvider/useProvider/useSigner/useNetwork hooks, but the shipped main entry lib/index.js contains web3.js Subscriptions code plus a large obfuscated payload wrapped in a Function("ObbvO95", "...") constructor that is invoked at module load. The payload uses randomized hex-named identifiers, a signed-integer decode table, and a doubly-unicode-escaped string body to hide its behavior from static inspection. Any consumer that require('eth-react-provider') executes this opaque code in the installer's process. The src/index.js in the tarball contains the clean web3.js source without this payload, indicating the built artifact was tampered. The README/code mismatch (documented React hook API vs. actual web3.js Subscriptions plus loader) is consistent with a trojanized lookalike package rather than a broken release.

    References: https://www.npmjs.com/package/eth-react-provider/v/1.0.0

    Affected packages

    Package

    Name: eth-react-provider

    Purl: pkg:npm/eth-react-provider

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0