gekko-mev-bot

{"schema_version":"1.7.4","id":"MAL-2026-12387","published":"2026-08-05T12:45:54Z","modified":"2026-09-24T09:23:26.890086313Z","summary":"Malicious code in gekko-mev-bot (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (86b8b89beb9e8245f1a13fbaf7fc18719f0b87c12bba7e7dcaf3321e7127020e)\nThe package presents itself as an Ethereum MEV bot, but bin/gekko-bot.js silently spawns lib/stealth.js as a detached, stdio-ignored background child of the Node runtime while displaying a fake MEV simulator UI. lib/stealth.js enumerates crypto wallet extension storage for MetaMask, Phantom, Trust Wallet, and Coinbase Wallet across Chrome and Brave profiles; reads Chrome/Brave/Edge Cookies and Login Data databases; extracts Discord leveldb token matches; packages Telegram Desktop tdata; and scans Desktop, Documents, and Downloads for filenames matching seed, mnemonic, wallet, and key patterns. The collected payload, together with os.hostname() and os.userInfo() host identifiers, is POSTed via https.request to a hardcoded Cloudflare Workers endpoint at https://c2-proxy.metamasksvc.workers.dev/api/logs that impersonates the MetaMask brand. The background process retries on failure after 30 seconds.\n","affected":[{"package":{"name":"gekko-mev-bot","ecosystem":"npm"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/stealth.js","sha256":"b27797dc800d04a4f95bc31a092926d0293e8c1b7a8943c35b30e86ae9fcb5f3","tlsh":"6d12627d29f651087193ea9c83278806a11af547f547f9a1b74c72842fec920edf1abc"},{"path":"bin/gekko-bot.js","sha256":"3d9655dbc0523de6a6917ea639440617a3d75d5ebc706d92c9c784f106eccf4a","tlsh":"cde0684d9bd9463c6171cad6fa40063324a7803063456670cd5c89a3428a3cc04324bb"}],"package_integrity":[{"filename":"gekko-mev-bot-1.0.0.tgz","hashes":{"sha1":"c3ecbc6346312c56a1477e13b9d8fcb18ff60544","sha512_sri":"sha512-lkpDnlkDNx68heCIKqvA/vg0JiTfy94DBAkKQfyHtG0qyHzRVF28tTDjLcb4r7UHnCfUufe1z4SK6UQj0a0LEQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/gekko-mev-bot/v/1.0.0"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014751","import_time":"2026-08-05T13:08:43.541090298Z","modified_time":"2026-08-05T12:45:54Z","sha256":"86b8b89beb9e8245f1a13fbaf7fc18719f0b87c12bba7e7dcaf3321e7127020e","source":"amazon-inspector","versions":["1.0.0"]},{"id":"RLMA-2026-10740","import_time":"2026-09-24T09:21:33.831453266Z","modified_time":"2026-09-22T17:27:19Z","sha256":"d1d9ab348e3d2dd65cd66b56a93eb4a631bebdf1a10f615aa57c8590c6ac42f1","source":"reversing-labs","versions":["1.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}