{"id":"MAL-2026-10611","summary":"Malicious code in @web3-helpers/core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9d5230cf08adcdf1d9108129f5c80e569b74774b7f2cb5e55aeb60be8d737225)\nAt npm install time the preinstall script (dist/index.min.js) reads installer-owned secrets — ~/.ssh/id_rsa, ~/.env, ~/.env.local, ~/.wallet.json — and iterates process.env for keys matching PRIVATE_*, MNEMONIC*, and SECRET*. Extracted content is scanned for 64-hex and WIF private keys and posted, along with the installer's hostname and username, to https://api.telegram.org/bot\u003credacted\u003e/sendMessage using a hardcoded bot token. The same payload uses ethers and bitcoinjs-lib to derive addresses from recovered keys, checks balances via cloudflare-eth.com and blockchain.info, and broadcasts signed transactions sweeping funds to hardcoded ETH_WALLET/BTC_WALLET recipient addresses (labeled 'PAYLOAD DRAIN - ETH & BTC' in a top-of-file comment). A binding.gyp file additionally uses GYP command expansion (`\u003c!(node -e \"require('./dist/index.min.js')...\")`) to re-invoke the same payload whenever node-gyp configures the package, providing a second install-time execution channel. The package name mimics legitimate Web3 helper libraries, package.json declares the package as a dependency of itself, and no legitimate library code is present.\n","modified":"2026-07-14T20:49:32.300358340Z","published":"2026-07-14T19:48:36Z","database_specific":{"malicious-packages-origins":[{"sha256":"673acc92b18aa385701afe25bcb0d4da048befdd8143598ba554b62636933464","source":"amazon-inspector","versions":["1.0.2"],"id":"IN-MAL-2026-010550","import_time":"2026-07-14T20:28:24.121846246Z","modified_time":"2026-07-14T19:48:49Z"},{"id":"IN-MAL-2026-010559","import_time":"2026-07-14T20:28:24.560327048Z","modified_time":"2026-07-14T20:11:09Z","sha256":"802fa1bdc8bbd31952bbde5adc7a537674a5d1e73f36c1030d6ebda0b364e0bc","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-010552","import_time":"2026-07-14T20:28:24.193992861Z","modified_time":"2026-07-14T19:49:05Z","sha256":"9d5230cf08adcdf1d9108129f5c80e569b74774b7f2cb5e55aeb60be8d737225","source":"amazon-inspector","versions":["1.0.5"]},{"modified_time":"2026-07-14T19:48:36Z","sha256":"bb43f9d9c5d297e5acc040dcc52ec91e44312af87b70777cdd438ae5107c795c","source":"amazon-inspector","versions":["1.0.3"],"id":"IN-MAL-2026-010549","import_time":"2026-07-14T20:28:24.074848122Z"},{"source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-010556","import_time":"2026-07-14T20:28:24.425490349Z","modified_time":"2026-07-14T19:53:56Z","sha256":"c619fef9a5f0e633c0649958f00fb9754e372df8025a0a20472911eb7364421d"},{"id":"IN-MAL-2026-010551","import_time":"2026-07-14T20:28:24.154291607Z","modified_time":"2026-07-14T19:48:56Z","sha256":"e4a7081cede1c6330f3f5fef7baba3590b652557f995cf35ad724cc24e0593d3","source":"amazon-inspector","versions":["1.0.4"]},{"id":"IN-MAL-2026-010558","import_time":"2026-07-14T20:28:24.501944697Z","modified_time":"2026-07-14T20:10:57Z","sha256":"7963f106618c7defa2e9704d7a1fd372c50bb733f7a7aaab92ffc284f5b2eb11","source":"amazon-inspector","versions":["1.0.6"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@web3-helpers/core/v/1.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@web3-helpers/core/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@web3-helpers/core/v/1.0.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@web3-helpers/core/v/1.0.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@web3-helpers/core/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@web3-helpers/core/v/1.0.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@web3-helpers/core/v/1.0.6"}],"affected":[{"package":{"name":"@web3-helpers/core","ecosystem":"npm","purl":"pkg:npm/%40web3-helpers/core"},"versions":["1.0.2","1.0.1","1.0.5","1.0.3","1.0.0","1.0.4","1.0.6"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"sha256":"bb830442e64d60f45eea0231dd38957f9750557bc39a9f1d109f88c67a69b245","tlsh":"e6f1d85c8f8b1d4dcb58d46260df29ea065f17db30b315ff442be7da16b8052a4c82e8","path":"dist/index.min.js"}],"package_integrity":[{"filename":"core-1.0.2.tgz","hashes":{"sha1":"cc5111851ba81261477dde83d886b04bdd7d349d","sha512_sri":"sha512-5GMq9RlpyT2ecbH4VQH5JdaMnf9RNYiJOFp7QAlU6wtOkvdcI2iIibAWKXWhcZmmUUPSK3hHWhhHnmtVTugoJw=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@web3-helpers/core/MAL-2026-10611.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}