MAL-2026-5440

    Dashboard / Malicious Package / MAL-2026-5440

    MAL-2026-5440

    Published: 9 Jun 2026Last Modified: 9 Jun 2026

    Summary: Malicious code in exodus-ethereum-sdk (npm)

    Details: Source: amazon-inspector (b4e52a42f8980da0a9df361ef772ca31bbdaec85eb3fc7a73dbcfc8b5ca6894a) Package name impersonates the Exodus cryptocurrency wallet brand and ships no real functionality (src/index.js exports an empty object; package.json self-describes as a 'HackerOne PoC'). The package.json declares a postinstall hook (`node src/canary.js`) which fires automatically on `npm install`. src/canary.js performs a DNS lookup and HTTPS GET to a hardcoded `96e03fa6c292469a-172-245-86-254.serveousercontent.com` subdomain — Serveo is an anonymous reverse-tunnel service, so the destination is operator-controlled and not tied to any identifiable publisher. Each install reveals the installer's public IP and DNS resolver to whoever currently controls that tunnel. Combined with the brand-impersonating name (installers may pull this expecting a legitimate Exodus SDK), the package functions as an install-time beacon against unsuspecting installers regardless of the author's stated 'research' intent.

    References: https://www.npmjs.com/package/exodus-ethereum-sdk/v/99.0.0-canary.1

    Affected packages

    Package

    Name: exodus-ethereum-sdk

    Purl: pkg:npm/exodus-ethereum-sdk

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    99.0.0-canary.1
    MAL-2026-5440 | CVE-DB