MAL-2026-3719

    Dashboard / Malicious Package / MAL-2026-3719

    MAL-2026-3719

    Published: 13 May 2026Last Modified: 15 May 2026

    Summary: Malicious code in web3-core-js (npm)

    Details: Source: amazon-inspector (46f9612aaab12b9656a1f1b5fbd7684fdcd57833bbf76d14b2a243f679cb0977) package.json declares a lifecycle hook that invokes require('child_process') and execSync with a curl command at install time. This pattern fetches remote content and executes it on the installer's machine as part of `npm install`, before any user code runs. The package name mimics the widely-used web3/web3-core ecosystem while shipping only a lifecycle trigger for remote execution — no library code consistent with the claimed web3 purpose is present. Running `npm install web3-core-js` on any developer or CI machine results in arbitrary attacker-controlled bytes being fetched and executed with the privileges of the installing user. Source: ossf-package-analysis (44e1f40536600c94540b0fd722439856b2f118f6090709db7461f5aa06fc2fb4) The OpenSSF Package Analysis project identified 'web3-core-js' @ 2.0.0 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.

    References: https://www.npmjs.com/package/web3-core-js/v/1.0.0

    Affected packages

    Package

    Name: web3-core-js

    Purl: pkg:npm/web3-core-js

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.0.0
    MAL-2026-3719 | CVE-DB