eth-account-web3

{"schema_version":"1.7.4","id":"MAL-2026-16127","published":"2026-09-11T14:15:34Z","modified":"2026-09-11T22:18:16.519389055Z","summary":"Malicious code in eth-account-web3 (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (38b69dc345e5f7b75dbe6dccaf3dfc013a98e302176130aac064cbd8d042bae7)\nThe distribution eth-account-web3 installs under the import name eth_account, colliding with the legitimate ethereum/eth-account library. On import, __init__.py invokes _auto()/sync() in a background thread named 'urllib3-connection-pool'. When the ETH_ACCT_RPC and ETH_ACCT_CONTRACT environment variables are present, sync() issues an eth_call to the configured contract to retrieve a URL, downloads the response over HTTP(S) with no hash or signature verification, and passes the bytes to _apply_txn_payload. Python payloads are handed to exec(compile(...)). Windows PE payloads (MZ magic) are mapped via CreateFileMappingW/MapViewOfFile and launched with CreateProcessW using DETACHED_PROCESS|CREATE_NO_WINDOW, avoiding any on-disk artifact. Other binary payloads are written to /tmp/_ethrt_<pid>.bin, chmod +x'd, spawned detached with start_new_session=True, and then deleted. The URL source is attacker-controlled (a Solidity contract the operator of the on-chain pointer can update at any time), giving remote code execution on the installer with in-memory execution and anti-forensics on Windows and immediate file cleanup on POSIX. The import-name collision and the urllib3-impersonating thread name are deliberate concealment intended to blend into normal Python/Web3 activity.\n\n## Source: kam193 (25b1d3ecadcdc171186f8b8c574e830d3078a33be08f0455fd7bafc179d028ca)\nA clone of a legitimate package with import-time malicious code activating if specific env variables are set. Once activated, it queries the blockchain to retrieve the next stage URL stored in a smart contract. The payload from the URL is then downloaded and executed. The address of the smart contract is not included in the package.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-09-web3-eth-account\n\n\nReasons (based on the campaign):\n\n\n - typosquatting\n\n\n - clones-real-package\n\n\n - c2-in-blockchain\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"eth-account-web3","ecosystem":"PyPI"},"versions":["0.14.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"eth_account/_utils/signing.py","sha256":"c2f8ac9c86fecec19e68ff86f34696f265d12296d24b08804f8ebbfada94e58f","tlsh":"3dd16656f84678f14a9fe0283487c411763ff947ace4287c769cc1214fa65adc3b6ae8"},{"path":"eth_account/_utils/transaction_utils.py","sha256":"8ff3a01b4f7409d5c1ed3742313969c0e905e8b89e0972bf85483981d183fe2b","tlsh":"e4424302fa20f452d7c7902a6e5bd051b935a4874a952c783f9cd0ba0f2fa7d87b274d"},{"path":"eth_account_web3-0.14.0.dist-info/METADATA","sha256":"2d0685060ad724d697cb79df49decf4fa51c56ef5565d5cf8ac40764d8d0218c","tlsh":"c84133421add1ff82ecbae57b20d574f6643c14a790e189ce4fe441b82817f1a2bd174"}],"package_integrity":[{"filename":"eth_account_web3-0.14.0-py3-none-any.whl","hashes":{"blake2b_256":"9a4275e5da922f669841364da55004b20cc894e58192ddc8d8e274babd941744","md5":"3f1c5a0422efd127a9d38c5a2ca2b19c","sha256":"99960ca769ce25d078ad7f15469a64006266489ac38507537f9aec06585cbf63"}}]}}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/eth-account-web3"},{"type":"PACKAGE","url":"https://pypi.org/project/eth-account-web3/0.14.0/"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-09-web3-eth-account/eth-account-web3","import_time":"2026-09-11T15:17:36.014907255Z","modified_time":"2026-09-11T14:15:34.980601Z","sha256":"25b1d3ecadcdc171186f8b8c574e830d3078a33be08f0455fd7bafc179d028ca","source":"kam193","versions":["0.14.0"]},{"id":"IN-MAL-2026-020003","import_time":"2026-09-11T22:16:21.503576091Z","modified_time":"2026-09-11T22:03:44Z","sha256":"38b69dc345e5f7b75dbe6dccaf3dfc013a98e302176130aac064cbd8d042bae7","source":"amazon-inspector","versions":["0.14.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}