eth-batcher

{"modified":"2026-08-19T02:46:03Z","published":"2026-08-19T02:46:03Z","schema_version":"1.7.4","id":"MAL-2026-14208","summary":"Malicious code in eth-batcher (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e2a725b819260b649f04c27142a0c6e5d219304f6ab038f8717533c2b3416599)\nindex.js is a verbatim copy of an unrelated Mongoose LeanHooks Plugin with a ~149 KB obfuscated Function(...) payload concatenated onto the module.exports line. On require(), the payload constructs and executes code decoded from a hex byte table via an XOR/rotation decoder. The advertised purpose in package.json (Ethereum JSON-RPC batching) does not match the shipped code, which contains no Ethereum or Web3 logic — the mismatched benign source acts as a cover for the appended dropper. Any process that imports this package executes the decoded payload at load time.\n","affected":[{"package":{"ecosystem":"npm","name":"eth-batcher"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"38de1f04d737182b9c5f87d7aff8b0e6f778fe14c1407c38b915e8da2fb610fb","tlsh":"0ae3bb4029927428a90dc1e245b88ffec747599ea748b85fe142e4daf1f4bf354fca18"}],"package_integrity":[{"filename":"eth-batcher-1.0.0.tgz","hashes":{"sha1":"2c222154e954a2ca6987779f8c9abc25414bfde5","sha512_sri":"sha512-4B4cuRtXGA25Sm3L8tHLc4OZdHkWPAhSInQ8gxHrsfatsYmQAmjLY/yhBi52IFDeeEQ2GP4rMsGnJtGXz6U5Rw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/eth-batcher/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018299","import_time":"2026-08-19T02:57:22.031790964Z","modified_time":"2026-08-19T02:46:03Z","sha256":"e2a725b819260b649f04c27142a0c6e5d219304f6ab038f8717533c2b3416599","source":"amazon-inspector","versions":["1.0.0"]}]}}