eth-crypto-utils

{"modified":"2026-08-05T12:47:15Z","published":"2026-08-05T12:47:15Z","schema_version":"1.7.4","id":"MAL-2026-12372","summary":"Malicious code in eth-crypto-utils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d4766af8f78c9d0a3836222bd3986232b5e49086285f88d93e5c3044e3b75600)\nOn require of index.js, the package initiates an HTTPS POST to the hardcoded endpoint https://enjbyg3xk8l.x.pipedream.net/beacon carrying a JSON payload that includes the full process.env, os.hostname(), os.userInfo().username, and os.homedir(). The bulk process.env dump exposes any credentials or tokens present in the installer's environment (AWS keys, GitHub/npm tokens, CI secrets, etc.). The transmission fires as a side effect of importing the package, with no caller opt-in and no relationship to any advertised cryptographic utility functionality. The declared package name suggests Ethereum cryptography helpers, which does not match the observed beacon behavior.\n","affected":[{"package":{"ecosystem":"npm","name":"eth-crypto-utils"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"6086dc2f6aa3fce37fdba1b740775acf62c7bc87915154083cb05f36eece88e5","tlsh":"074131b56979b02846b351d888a9cd1fa7abe1523a03d4e4b75d28440fcae78d8f1da0"}],"package_integrity":[{"filename":"eth-crypto-utils-1.0.0.tgz","hashes":{"sha1":"1ae70355af901922614306067db070a1c81262d7","sha512_sri":"sha512-RLFZNlJ/bwUzbaRKhn+nbH/lq8n/W67SFugF5Lz+BHVQjptUvDImo5j6HBIG5wTp/EB0maB+hw3dBbWknGjQYA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/eth-crypto-utils/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014761","import_time":"2026-08-05T13:08:44.446410435Z","modified_time":"2026-08-05T12:47:15Z","sha256":"d4766af8f78c9d0a3836222bd3986232b5e49086285f88d93e5c3044e3b75600","source":"amazon-inspector","versions":["1.0.0"]}]}}