{"id":"MAL-2026-14208","summary":"Malicious code in eth-batcher (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e2a725b819260b649f04c27142a0c6e5d219304f6ab038f8717533c2b3416599)\nindex.js is a verbatim copy of an unrelated Mongoose LeanHooks Plugin with a ~149 KB obfuscated Function(...) payload concatenated onto the module.exports line. On require(), the payload constructs and executes code decoded from a hex byte table via an XOR/rotation decoder. The advertised purpose in package.json (Ethereum JSON-RPC batching) does not match the shipped code, which contains no Ethereum or Web3 logic — the mismatched benign source acts as a cover for the appended dropper. Any process that imports this package executes the decoded payload at load time.\n","modified":"2026-08-19T03:00:13.681605995Z","published":"2026-08-19T02:46:03Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-19T02:57:22.031790964Z","modified_time":"2026-08-19T02:46:03Z","sha256":"e2a725b819260b649f04c27142a0c6e5d219304f6ab038f8717533c2b3416599","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-018299"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/eth-batcher/v/1.0.0"}],"affected":[{"package":{"name":"eth-batcher","ecosystem":"npm","purl":"pkg:npm/eth-batcher"},"versions":["1.0.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/eth-batcher/MAL-2026-14208.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"eth-batcher-1.0.0.tgz","hashes":{"sha1":"2c222154e954a2ca6987779f8c9abc25414bfde5","sha512_sri":"sha512-4B4cuRtXGA25Sm3L8tHLc4OZdHkWPAhSInQ8gxHrsfatsYmQAmjLY/yhBi52IFDeeEQ2GP4rMsGnJtGXz6U5Rw=="}}],"evidence_files":[{"path":"index.js","sha256":"38de1f04d737182b9c5f87d7aff8b0e6f778fe14c1407c38b915e8da2fb610fb","tlsh":"0ae3bb4029927428a90dc1e245b88ffec747599ea748b85fe142e4daf1f4bf354fca18"}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}