MAL-2026-5352

    Dashboard / Malicious Package / MAL-2026-5352

    MAL-2026-5352

    Published: 9 Jun 2026Last Modified: 9 Jul 2026

    Summary: Malicious code in blockchain-helper-0 (npm)

    Details: **Note:** *This report is updated by a verification record* Crypto/SSH/wallet stealer (self-labeled "CRYPTO STEALER"). postinstall scripts/postinstall.js auto-execs, src/index.js harvests ~/.ssh/id_rsa + wallet keys/seeds + env and exfils to hardcoded Telegram bot 8227918239:AAGEMDrBZluDsBBYPxfSyMuv2l3FY8cZCcs chat 6433587894. Auto-exec + hardcoded attacker Telegram exfil; "blockchain-helper" identity has no reason to read SSH/wallet keys. Source: amazon-inspector (8b9fac34e13ad38cb702f7aad434d18aa276005fe5fa4cbe48c7eb65af26623d) The package was found to contain malicious code or consuming dependency that contains malicious code

    References: https://app.safedep.io/community/malysis/01KTN3QACESWZP4EK3W7D1JJGC, https://www.npmjs.com/package/blockchain-helper-0/v/1.0.0

    Affected packages

    Package

    Name: blockchain-helper-0

    Purl: pkg:npm/blockchain-helper-0

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    1.0.0