Malicious code in web3-eth-account (PyPI)

Source: kam193 bd36aeb2d45881a66bf5373c0b91a108637938dab5e0c153525e6f938c9c9503 A clone of a legitimate package with import-time malicious code activating if specific env variables are set. Once activated, it queries the blockchain to retrieve the next stage URL stored in a smart contract. The...

Malicious code in eth-account-web3 (PyPI)

Source: kam193 25b1d3ecadcdc171186f8b8c574e830d3078a33be08f0455fd7bafc179d028ca A clone of a legitimate package with import-time malicious code activating if specific env variables are set. Once activated, it queries the blockchain to retrieve the next stage URL stored in a smart contract. The...

Malicious code in eth-account-web3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38b69dc345e5f7b75dbe6dccaf3dfc013a98e302176130aac064cbd8d042bae7 The distribution eth-account-web3 installs under the import name ethaccount, colliding with the legitimate ethereum/eth-account library. On import,...

MAL-2026-16127 Malicious code in eth-account-web3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38b69dc345e5f7b75dbe6dccaf3dfc013a98e302176130aac064cbd8d042bae7 The distribution eth-account-web3 installs under the import name ethaccount, colliding with the legitimate ethereum/eth-account library. On import,...

Malicious code in web3-eth-account (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19e3eadaccc63a1e12d0e3cfe153cbf78e114f30285d4da3694990827e5f5c5a The package web3-eth-account typosquats the legitimate eth-account library and copies its metadata ApeWorX/ethereum.org author addresses, README...

MAL-2026-16129 Malicious code in web3-eth-account (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19e3eadaccc63a1e12d0e3cfe153cbf78e114f30285d4da3694990827e5f5c5a The package web3-eth-account typosquats the legitimate eth-account library and copies its metadata ApeWorX/ethereum.org author addresses, README...

Malicious Package

Overview eth-account-wallet is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in eth-account-wallet (PyPI)

Source: kam193 4e0a297fd6a2bfc0e15f9aac09c92768a4725458ad282594e97ec15bb3fa8c5f During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category: MALICIOUS - The campaign has clearly malicious intent, li...

MAL-2026-13372 Malicious code in eth-account-wallet (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc3337915e7c14a0ceb6743d1edf2e607fd7926656b49cdd041d7b161b718178 eth-account-wallet 0.11.2 is a typosquat of the eth-account PyPI package. Its setup.py installs a custom install cmdclass PI that, on pip install,...

Malicious Package

Overview eth-account-web3 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview web3-eth-account is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in eth-account-api (PyPI)

--- Credit: OpenSSF source...

0x-order-utils (>=1.0.2, <=1.1.1), 0x-web3 (>=4.7.1, <=5.0.0a5) +134 more potentially affected by CVE-2022-1930 via eth-account (>=0.1.0a2, <=0.5.8)

eth-account PYPI version =0.1.0a2, =1.0.2, =4.7.1, =0.1.13, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.0, =0.0.0, =0.0.0, =0.0.5, =0.1.0 and more Source cves: CVE-2022-1930 Source advisory: OSV:PYSEC-2026-806...

PYSEC-2026-806 Regular expression denial of service in eth-account

An exponential ReDoS Regular Expression Denial of Service can be triggered in the eth-account PyPI package, when an attacker is able to supply arbitrary input to the encodestructureddata method...

EUVD-2022-6626

Malicious code in bioql PyPI...

CVE-2022-1930

An exponential ReDoS Regular Expression Denial of Service can be triggered in the eth-account PyPI package, when an attacker is able to supply arbitrary input to the encodestructureddata method...

MAL-2024-9973 Malicious code in eth-account-api (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Regular Expression Denial Of Service (ReDoS)

eth-account is vulnerable to regular expression denial of service. The vulnerability exists due to the insecure regex pattern used for the TYPEREGEX attribute in the validatetypesattribute function of validation.py, allowing an attacker to crash the application by providing a malicious input...

Regular expression denial of service in eth-account

An exponential ReDoS Regular Expression Denial of Service can be triggered in the eth-account PyPI package, when an attacker is able to supply arbitrary input to the encodestructureddata method...

0x-order-utils (>=1.0.2, <=1.1.1), 0x-web3 (>=4.7.1, <=5.0.0a5) +134 more potentially affected by CVE-2022-1930 via eth-account (>=0.1.0a2, <=0.5.8)

eth-account PYPI version =0.1.0a2, =1.0.2, =4.7.1, =0.1.13, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.0, =0.0.0, =0.0.0, =0.0.5, =0.1.0 and more Source cves: CVE-2022-1930 Source advisory: OSV:GHSA-V65G-F3CJ-FJP4...