{"id":"MAL-2026-12387","summary":"Malicious code in gekko-mev-bot (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (86b8b89beb9e8245f1a13fbaf7fc18719f0b87c12bba7e7dcaf3321e7127020e)\nThe package presents itself as an Ethereum MEV bot, but bin/gekko-bot.js silently spawns lib/stealth.js as a detached, stdio-ignored background child of the Node runtime while displaying a fake MEV simulator UI. lib/stealth.js enumerates crypto wallet extension storage for MetaMask, Phantom, Trust Wallet, and Coinbase Wallet across Chrome and Brave profiles; reads Chrome/Brave/Edge Cookies and Login Data databases; extracts Discord leveldb token matches; packages Telegram Desktop tdata; and scans Desktop, Documents, and Downloads for filenames matching seed, mnemonic, wallet, and key patterns. The collected payload, together with os.hostname() and os.userInfo() host identifiers, is POSTed via https.request to a hardcoded Cloudflare Workers endpoint at https://c2-proxy.metamasksvc.workers.dev/api/logs that impersonates the MetaMask brand. The background process retries on failure after 30 seconds.\n","modified":"2026-08-05T13:35:29.551492143Z","published":"2026-08-05T12:45:54Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-08-05T12:45:54Z","sha256":"86b8b89beb9e8245f1a13fbaf7fc18719f0b87c12bba7e7dcaf3321e7127020e","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-014751","import_time":"2026-08-05T13:08:43.541090298Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/gekko-mev-bot/v/1.0.0"}],"affected":[{"package":{"name":"gekko-mev-bot","ecosystem":"npm","purl":"pkg:npm/gekko-mev-bot"},"versions":["1.0.0"],"database_specific":{"indicators":{"evidence_files":[{"tlsh":"6d12627d29f651087193ea9c83278806a11af547f547f9a1b74c72842fec920edf1abc","path":"lib/stealth.js","sha256":"b27797dc800d04a4f95bc31a092926d0293e8c1b7a8943c35b30e86ae9fcb5f3"},{"path":"bin/gekko-bot.js","sha256":"3d9655dbc0523de6a6917ea639440617a3d75d5ebc706d92c9c784f106eccf4a","tlsh":"cde0684d9bd9463c6171cad6fa40063324a7803063456670cd5c89a3428a3cc04324bb"}],"package_integrity":[{"filename":"gekko-mev-bot-1.0.0.tgz","hashes":{"sha512_sri":"sha512-lkpDnlkDNx68heCIKqvA/vg0JiTfy94DBAkKQfyHtG0qyHzRVF28tTDjLcb4r7UHnCfUufe1z4SK6UQj0a0LEQ==","sha1":"c3ecbc6346312c56a1477e13b9d8fcb18ff60544"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/gekko-mev-bot/MAL-2026-12387.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}