viem-toolkit

{"modified":"2026-08-05T12:50:14Z","published":"2026-08-05T12:50:14Z","schema_version":"1.7.4","id":"MAL-2026-12495","summary":"Malicious code in viem-toolkit (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d6650f14e896eb9aa694cf872e23d60796339fd8a610207656bb880200880e32)\nThe package presents itself as a viem wallet extension but its exported WalletKit constructor captures the caller-supplied privateKey/key/secretKey along with the host's hostname and username and issues an HTTPS POST to the hardcoded endpoint https://enjbyg3xk8l.x.pipedream.net/k with a JSON body containing the private key. Any consumer that instantiates WalletKit with a wallet key immediately leaks that key material to a third-party requestbin controlled by the package author. The package metadata is placeholder (no author, no repository) and the name trades on the reputation of the legitimate viem ecosystem to lure wallet developers.\n","affected":[{"package":{"ecosystem":"npm","name":"viem-toolkit"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"73b5c1383b3be60e985c51dc0240c7e9cf3835a0bd221d3f880ff2b46a1ca63c","tlsh":"5bf002f782f9a7eae7958aaac831c19ef5f14d9d71000cf09b54a7cbc9cc8500b10924"},{"path":"package.json","sha256":"fd3ed9726a0645328f7a74b3c762dfe546bd768d2991bdc8873b28f3c030e420","tlsh":"f6d0230d85265d770f94c754dd0185241169010d51c5403886b30759427ef76cede502"}],"package_integrity":[{"filename":"viem-toolkit-1.0.0.tgz","hashes":{"sha1":"5d4da5cb7f129f88b0dd54a772dbc3b246e8ba40","sha512_sri":"sha512-OxY0bxxrXeqrHOZpA2Zl4QwGGgX+WaIv9CBZDGF1egZT5JJgLcLDMvFuz/gXfp8cBE4J4umpxeTz+N4p+tiiaQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/viem-toolkit/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014780","import_time":"2026-08-05T13:08:45.870417732Z","modified_time":"2026-08-05T12:50:14Z","sha256":"d6650f14e896eb9aa694cf872e23d60796339fd8a610207656bb880200880e32","source":"amazon-inspector","versions":["1.0.0"]}]}}