web3-utils-crypto

{"modified":"2026-08-05T15:39:42Z","published":"2026-08-05T15:39:42Z","schema_version":"1.7.4","id":"MAL-2026-13354","summary":"Malicious code in web3-utils-crypto (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d1f0dfc7ad97140ef740758424cd859d9c25ee55a6d6346859cebaf1e64cdce9)\nweb3-utils-crypto impersonates the web3-utils library (package description: 'Drop-in replacement for web3-utils') and ships stub wallet APIs including generateMnemonic and createWallet that return non-functional random values. On require(), index.js serializes the full process.env plus os.hostname, username, homedir, platform, cwd, package name/version and timestamp, base64-encodes the payload, and sends it via HTTPS GET to https://api.telegram.org/bot<token>/sendMessage with chat_id 8969499041 (bot id 7231970337). A tmp flag file suppresses repeat sends. process.env on developer and CI machines routinely contains AWS_*, GITHUB_TOKEN, NPM_TOKEN, DB_PASSWORD and similar credentials, so any consumer that installs and loads this package leaks its full environment to the attacker-controlled Telegram chat.\n","affected":[{"package":{"ecosystem":"npm","name":"web3-utils-crypto"},"versions":["1.10.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"0389798ca541ef95ca6ef2b0095231fe0f56ae259ed19bdc793aab2f0b47b017","tlsh":"a421748827f2f84e17739481a92f6a0ab3fbcea1084ce760c694d5c75f740c8d959798"}],"package_integrity":[{"filename":"web3-utils-crypto-1.10.4.tgz","hashes":{"sha1":"25512a6620a9908b5c101586466a8f539a58b5a0","sha512_sri":"sha512-RJge4vpgo2JND2OTpaQV4PpWzr8hhHEv4qoLI/+st5d0vANdDn/V1pbpHh38I1UU/GDEwdX9aujOelFWOTFkYg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/web3-utils-crypto/v/1.10.4"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015784","import_time":"2026-08-05T16:13:44.880958376Z","modified_time":"2026-08-05T15:39:42Z","sha256":"d1f0dfc7ad97140ef740758424cd859d9c25ee55a6d6346859cebaf1e64cdce9","source":"amazon-inspector","versions":["1.10.4"]}]}}