@origindev/ethaccount

{"modified":"2026-07-13T18:12:05Z","published":"2026-07-13T18:09:30Z","schema_version":"1.7.4","id":"MAL-2026-10455","summary":"Malicious code in @origindev/ethaccount (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (21a07b9029fb9a0c16ec0d934edab2123c43d1999489d510c3bbabc5a0f1d5e7)\n@origindev/ethaccount@1.0.0 ships a single heavily obfuscated index.js wrapped in an RC4 string-array decoder with IIFE rotation and a self-defending regex guard. All literal strings — including the require target, the exported method name, the HTTP method, and the destination URL — are encrypted across eight concatenated fragments, preventing static auditing of the network destination. The module exports one function (internal name `wallets`) that takes a single argument and unconditionally issues `axios.<method>(API_BASE_URL + arg)` to a hardcoded author-controlled endpoint, silently swallowing any error. Combined with the package name `ethaccount`, the description \"evm tool for validation entry\", and the exported function name `wallets`, the obvious intent is for callers to pass wallet/account material (private keys, seed phrases, or account identifiers) which is then forwarded to the attacker. The published manifest also diverges from the README, which instructs `npm install evm_account` — a different package name — indicating impersonation of an unrelated target. The author field is blank, there is no documented purpose for the relay, and the destination is deliberately concealed.\n","affected":[{"package":{"ecosystem":"npm","name":"@origindev/ethaccount"},"versions":["1.0.0","1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"63705606ed29bc381ea3402b8b28fe6fb0eb88380f441de4421bff2ae221d2a9","tlsh":"95c2cdc077c0e803228f5b73bf26b9e9e02a98b539d8a44bd254798cb5b9507d5b4df0"},{"path":"README.md","sha256":"21e18b38b6fe70ee35035233075259df46cedfc4fd04586114c08f1210e5b8c4","tlsh":"0570000c000000222c020a202c02220802c0083002b28c0e08ca28002082aac000200e"}],"package_integrity":[{"filename":"ethaccount-1.0.0.tgz","hashes":{"sha1":"3fbdaf6182bf5229256fca97e2e49bfd2aff29a2","sha512_sri":"sha512-uJa+7w2+7wwXu4gA7jUe88S8IfyiaJcOZKeNkpdmsVJJKs0yvFyjlcq6y9LKbrh06HrTNwqqVycPK/1wetUDsg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@origindev/ethaccount/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@origindev/ethaccount/v/1.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010285","import_time":"2026-07-13T18:10:13.469142588Z","modified_time":"2026-07-13T18:09:40Z","sha256":"21a07b9029fb9a0c16ec0d934edab2123c43d1999489d510c3bbabc5a0f1d5e7","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-010284","import_time":"2026-07-13T18:10:13.393015954Z","modified_time":"2026-07-13T18:09:30Z","sha256":"fd3b0591b810ac5be23655f1f40b3c30abdbe29b93ab8cd027c4201a2bc0b18e","source":"amazon-inspector","versions":["1.0.1"]}]}}