MAL-2026-950

    Dashboard / Malicious Package / MAL-2026-950

    MAL-2026-950

    Published: 19 Feb 2026Last Modified: 20 Feb 2026

    Summary: Malicious code in web3tool (PyPI)

    Details: Source: kam193 (50b63ced7e162150a14fbfb557df8683707b72b361caf1243a14468fd910a036) The malicious code is in the ethrpc-keys package, which is a clone of legitimate eth-keys, but contains a modification that silently exfiltrates the user's private key. Other packages in the campaign are also clones of legitimate packages, but the only modification is in pulling (directly or traversally) the malicious dependency. At the end, all packages in the campaign exfiltrate the private key. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-02-old-ethrpc-keys Reasons (based on the campaign): - clones-real-package - exfiltration-crypto - crypto-related - action-hidden-in-lib-usage - The malicious code is intentionally included in a dependency of the package

    References: https://bad-packages.kam193.eu/pypi/package/web3tool

    Affected packages

    Package

    Name: web3tool

    Purl: pkg:pypi/web3tool

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    6.6.1
    6.6.2
    6.6.3
    6.6.4
    6.6.5
    6.6.6
    MAL-2026-950 | CVE-DB