{"id":"MAL-2026-5356","summary":"Malicious code in ethereum-kit-9 (npm)","details":"Crypto/SSH/wallet stealer, blockchain-helper-0 campaign sibling (c960+). postinstall auto-execs, src/index.js harvests ~/.ssh/id_rsa+id_ed25519+Sol/Eth/BTC/Tron/Sui/Aptos wallets+.env+seeds, self-labels \"CRYPTO STEALER\", exfils to SAME Telegram bot 8227918239 chat 6433587894 (not rotated). Campaign now uses inflated version (1.25.36) not 1.0.0.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (fca6873d6bb09703d4ceba095e845845ec40ca4274def05870ed6d59b90fdf6a)\nOn `npm install`, the package's postinstall hook loads src/index.js, which after a short delay and a sandbox/CI evasion check enumerates the installer's home and project directories for sensitive files and uploads each one to api.telegram.org using a hardcoded bot token and chat_id. Targeted paths include SSH private keys (~/.ssh/id_rsa, id_ed25519), crypto wallet keystores and data directories for Solana, Ethereum (~/.ethereum/keystore), Bitcoin, Tron, Sui, and Aptos, and project secrets (.env,.env.local, mnemonic.txt, seed.txt, wallet.json, private.key, secrets.json). The payload skips execution when CI/sandbox indicators are present (CI=true, GITHUB_ACTIONS, NODE_ENV=test/development, usernames like runner/sandbox/docker/jenkins, and 12-hex-char container hostnames) to evade analysis. The package name and generic 'Utility library' description with placeholder author impersonate Ethereum tooling to lure developers.\n","modified":"2026-06-11T02:31:32.056543802Z","published":"2026-06-09T07:55:35Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-06-11T01:39:32Z","id":"IN-MAL-2026-005351","versions":["1.25.36"],"source":"amazon-inspector","import_time":"2026-06-11T02:24:27.113320556Z","sha256":"fca6873d6bb09703d4ceba095e845845ec40ca4274def05870ed6d59b90fdf6a"}]},"references":[{"type":"REPORT","url":"https://app.safedep.io/community/malysis/01KTN73YXHEMD7EATFD58FKGEY"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/ethereum-kit-9/v/1.25.36"}],"affected":[{"package":{"name":"ethereum-kit-9","ecosystem":"npm","purl":"pkg:npm/ethereum-kit-9"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.25.36"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ethereum-kit-9/MAL-2026-5356.json","indicators":{"package_integrity":[{"hashes":{"sha512_sri":"sha512-U6YW4vR9XhYaZAd2vEcz3c9FD2yriVYv1fFP8SW4iwyI+FZWHMgrmQmJhy6lTRsdrcrZfQ/tdkpUqSqXRNJdCQ==","sha1":"fdf7ed482eaefd5219020cd370d1a43ea5c46da9"},"filename":"ethereum-kit-9-1.25.36.tgz"}],"evidence_files":[{"sha256":"c43afad949027040c6414d26fa4eea6e2671d2572f9df7fd595e12baf204854f","path":"src/index.js","tlsh":"36b121f40ee677148193e3a9624f60015436e1473c06ed65769c83c8af89a2ca6f2efc"},{"sha256":"e3eba8520925dea0013f70f2928d2e3394d338710bc158b0b992d952d655bb55","path":"package.json","tlsh":"f1d0a7200f10977335c48a6e0866510a6ab10e0f5048bc1417f72158838abf648be61e"}]}}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"SafeDep","contact":["https://safedep.io"],"type":"FINDER"}]}