{"id":"MAL-2026-16129","summary":"Malicious code in web3-eth-account (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (19e3eadaccc63a1e12d0e3cfe153cbf78e114f30285d4da3694990827e5f5c5a)\nThe package `web3-eth-account` typosquats the legitimate `eth-account` library and copies its metadata (ApeWorX/ethereum.org author addresses, README instructing `pip install eth-account`). On `import eth_account`, `__init__.py` calls `_auto()` which, when the environment variables `ETH_ACCT_RPC` and `ETH_ACCT_CONTRACT` are set, spawns a background thread (named `urllib3-connection-pool` for cover) that performs a JSON-RPC `eth_call` with selector `0x5600f04f` against an attacker-controlled Ethereum contract, decodes an ABI-encoded URL from contract storage, downloads bytes via `urllib.request.urlopen`, and hands them to `_apply_txn_payload` in `signing.py` / `transaction_utils.py`. That sink classifies the fetched bytes and executes them three ways: Python source via `exec(compile(...))`; Windows PE loaded in-memory via ctypes `CreateFileMappingW`/`MapViewOfFile`/`CreateProcessW`; otherwise written to `/tmp/_ethrt_\u003cpid\u003e.bin`, `chmod +x`, launched via `subprocess.Popen` in a new session with the file removed after launch. The C2 URL is resolved on-chain rather than embedded as a literal, defeating static URL extraction, and the dropper functions are disguised under transaction/signing names.\n\n## Source: kam193 (bd36aeb2d45881a66bf5373c0b91a108637938dab5e0c153525e6f938c9c9503)\nA clone of a legitimate package with import-time malicious code activating if specific env variables are set. Once activated, it queries the blockchain to retrieve the next stage URL stored in a smart contract. The payload from the URL is then downloaded and executed. The address of the smart contract is not included in the package.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-09-web3-eth-account\n\n\nReasons (based on the campaign):\n\n\n - typosquatting\n\n\n - clones-real-package\n\n\n - c2-in-blockchain\n\n\n - Downloads and executes a remote malicious script.\n","modified":"2026-09-11T22:30:03.748844222Z","published":"2026-09-11T14:12:59Z","database_specific":{"malicious-packages-origins":[{"source":"kam193","versions":["0.14.0"],"id":"pypi/2026-09-web3-eth-account/web3-eth-account","import_time":"2026-09-11T15:17:36.017038783Z","modified_time":"2026-09-11T14:13:00.028686Z","sha256":"bd36aeb2d45881a66bf5373c0b91a108637938dab5e0c153525e6f938c9c9503"},{"source":"amazon-inspector","versions":["0.14.0"],"id":"IN-MAL-2026-020004","import_time":"2026-09-11T22:16:21.553788503Z","modified_time":"2026-09-11T22:03:55Z","sha256":"19e3eadaccc63a1e12d0e3cfe153cbf78e114f30285d4da3694990827e5f5c5a"}]},"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/web3-eth-account"},{"type":"PACKAGE","url":"https://pypi.org/project/web3-eth-account/0.14.0/"}],"affected":[{"package":{"name":"web3-eth-account","ecosystem":"PyPI","purl":"pkg:pypi/web3-eth-account"},"versions":["0.14.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"web3_eth_account-0.14.0-py3-none-any.whl","hashes":{"blake2b_256":"99b3d2bc4f9a4d240434e69bcb171c262ed41262667b033e69b7f09e9cbb588a","md5":"058916340dc5026d18f9d6c6839813b7","sha256":"f228f0aaeb42afb97f88d63ed0303d5cd4ad9f34d95940da5dbb8746998c00c4"}}],"evidence_files":[{"sha256":"ab07297180ee7331e39190a79790040fb21435048a95a4a33bf139f1c4796635","tlsh":"6ae0ab20112868076d6f7b552861857c03f3a4d26a805c5c78dd57380fa1261c57152a","path":"eth_account/__init__.py"},{"tlsh":"e4424302fa20f452d7c7902a6e5bd051b935a4874a952c783f9cd0ba0f2fa7d87b274d","path":"eth_account/_utils/transaction_utils.py","sha256":"8ff3a01b4f7409d5c1ed3742313969c0e905e8b89e0972bf85483981d183fe2b"},{"tlsh":"8e4162a31aa91eb03fcabe87b248578fb557c18fa88f04dc9af9c41a81407f5517d064","path":"web3_eth_account-0.14.0.dist-info/METADATA","sha256":"3ea5bd52749a20909c55bc220475be157fe731588973fd3ac036c9ca09777ba6"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/web3-eth-account/MAL-2026-16129.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}