eth-react-provider

{"modified":"2026-08-19T10:14:36Z","published":"2026-08-19T10:14:36Z","schema_version":"1.7.4","id":"MAL-2026-14300","summary":"Malicious code in eth-react-provider (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7b9bdf79a694cbf6d1a840541b4c47fdac8dc6ac32f4b6a3d4887d5f81233387)\nThe package advertises itself as a React Ethereum provider exporting EthereumProvider/useProvider/useSigner/useNetwork hooks, but the shipped main entry lib/index.js contains web3.js Subscriptions code plus a large obfuscated payload wrapped in a Function(\"ObbvO95\", \"...\") constructor that is invoked at module load. The payload uses randomized hex-named identifiers, a signed-integer decode table, and a doubly-unicode-escaped string body to hide its behavior from static inspection. Any consumer that require('eth-react-provider') executes this opaque code in the installer's process. The src/index.js in the tarball contains the clean web3.js source without this payload, indicating the built artifact was tampered. The README/code mismatch (documented React hook API vs. actual web3.js Subscriptions plus loader) is consistent with a trojanized lookalike package rather than a broken release.\n","affected":[{"package":{"ecosystem":"npm","name":"eth-react-provider"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/index.js","sha256":"faaf7c7168b80ef8148c54ed779926fed0edd38bb391f980f5e12981bcbb9683","tlsh":"eeb3bac722fa961dcc92cea08df45e4d43a85422cfc510c4bf979d5ee6ae690ebe1344"},{"path":"README.md","sha256":"fb64b35dde8d878f96e9278195f9fac32aa9242901a2808d99fd76c4c8ff2ccb","tlsh":"0ac18438a57923c046630cc7bec76d65db9c306a304c80f966abe270d7d3e998ead5c5"}],"package_integrity":[{"filename":"eth-react-provider-1.0.0.tgz","hashes":{"sha1":"fe0aa0870dcfce8d5e8fb920191bc973ee558a88","sha512_sri":"sha512-EItjOF5tvXI5P6dVh/mfTOG6GKE42M0aYp3DMndl8PaOitbqeaq45cwBHdJ63TdEVoky5Zq0TB3KVIKGAZ1fCg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/eth-react-provider/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018420","import_time":"2026-08-19T10:44:44.683387848Z","modified_time":"2026-08-19T10:14:36Z","sha256":"7b9bdf79a694cbf6d1a840541b4c47fdac8dc6ac32f4b6a3d4887d5f81233387","source":"amazon-inspector","versions":["1.0.0"]}]}}