{"id":"MAL-2026-12372","summary":"Malicious code in eth-crypto-utils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d4766af8f78c9d0a3836222bd3986232b5e49086285f88d93e5c3044e3b75600)\nOn require of index.js, the package initiates an HTTPS POST to the hardcoded endpoint https://enjbyg3xk8l.x.pipedream.net/beacon carrying a JSON payload that includes the full process.env, os.hostname(), os.userInfo().username, and os.homedir(). The bulk process.env dump exposes any credentials or tokens present in the installer's environment (AWS keys, GitHub/npm tokens, CI secrets, etc.). The transmission fires as a side effect of importing the package, with no caller opt-in and no relationship to any advertised cryptographic utility functionality. The declared package name suggests Ethereum cryptography helpers, which does not match the observed beacon behavior.\n","modified":"2026-08-05T13:35:22.859853646Z","published":"2026-08-05T12:47:15Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-014761","import_time":"2026-08-05T13:08:44.446410435Z","modified_time":"2026-08-05T12:47:15Z","sha256":"d4766af8f78c9d0a3836222bd3986232b5e49086285f88d93e5c3044e3b75600"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/eth-crypto-utils/v/1.0.0"}],"affected":[{"package":{"name":"eth-crypto-utils","ecosystem":"npm","purl":"pkg:npm/eth-crypto-utils"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"hashes":{"sha512_sri":"sha512-RLFZNlJ/bwUzbaRKhn+nbH/lq8n/W67SFugF5Lz+BHVQjptUvDImo5j6HBIG5wTp/EB0maB+hw3dBbWknGjQYA==","sha1":"1ae70355af901922614306067db070a1c81262d7"},"filename":"eth-crypto-utils-1.0.0.tgz"}],"evidence_files":[{"tlsh":"074131b56979b02846b351d888a9cd1fa7abe1523a03d4e4b75d28440fcae78d8f1da0","path":"index.js","sha256":"6086dc2f6aa3fce37fdba1b740775acf62c7bc87915154083cb05f36eece88e5"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/eth-crypto-utils/MAL-2026-12372.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}