Malicious Package

Overview @solana-js/web3 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-13688 Malicious code in @kuperka/chainguard-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b799ca087f4396cb295cd53012a92d10dea0c763a41c8b85e94437108ea24e4 Package @kuperka/[email protected] exposes a single payload, window.VEIL.init, that on load harvests document.cookie, every...

MAL-2026-13687 Malicious code in tokocrytodev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88f51898e05da09842f561ce72f06378a6718f778fa0335b68bb4c0fda8cc5a6 On module load, tokocrytodev instantiates a StealthC2 agent and starts a polling loop that fetches commands from...

MAL-2026-12125 Malicious code in @zzzgenesis00/web3-utils-crypto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5f75dc3a679eaa0579352bb4d345acb84247d70f4e4db06e5de04ff6d20f4e5 @zzzgenesis00/web3-utils-crypto ships a postinstall.js that runs automatically on npm install and harvests installer-side secrets and host data. The...

Malicious code in @wethenorth12/solana-web3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54d27d76902370899c3362602581cdec59396e1ece2bd87976f1798083957f89 On require of the package's main entry index.js, the code collects process.env, hostname, username, homedir, platform, cwd and a timestamp,...

MAL-2026-12102 Malicious code in @wethenorth12/solana-web3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54d27d76902370899c3362602581cdec59396e1ece2bd87976f1798083957f89 On require of the package's main entry index.js, the code collects process.env, hostname, username, homedir, platform, cwd and a timestamp,...

MAL-2026-12107 Malicious code in @wethenorth12/web3-utils-crypto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc6591661338a325995ebe471f7d8157c1be9458f38336c4c11032033b150108 On module load, index.js collects the host identifiers os.hostname, os.userInfo.username, home directory, platform, cwd and the entire process.env,...

Malicious code in @wethenorth12/web3-utils-crypto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc6591661338a325995ebe471f7d8157c1be9458f38336c4c11032033b150108 On module load, index.js collects the host identifiers os.hostname, os.userInfo.username, home directory, platform, cwd and the entire process.env,...

MAL-2026-11994 Malicious code in @zzzgenesis00/web3-provider-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fae571005ccdcdc23e50fbee1eddc31d39355706b7945df3ccbb3096ecaf724b Package impersonates MetaMask's web3-provider-engine author field 'MetaMask', homepage pointing to github.com/MetaMask/web3-provider-engine while...

Malicious code in @zzzgenesis00/solana-web3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 433d4c4c3c8984e1fdd1a47623a9d5cf7c464ff9a64ce32846a76f10e3224dce This package impersonates Solana Labs author field 'solana-labs', repository pointing at github.com/solana-labs/solana-web3 under an unrelated scope...

MAL-2026-11233 Malicious code in @web3-util/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b6c5241d80dc8baa902550a561e37b238c483430f8c7b186abe033d11f8ea34 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview @solana-sdk/web3.js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-11227 Malicious code in @solana-sdk/web3.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 54e9ab1fe2590a2edf0b546231e23d61330ae2f1ee76f31b4df9afc8e4087d22 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @solana-sdk/web3.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 54e9ab1fe2590a2edf0b546231e23d61330ae2f1ee76f31b4df9afc8e4087d22 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview @wagnibot/web3 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Lottie Player - Backdoor Detection

Detectes vulnerable compormised version of lottie-player JS Library that were compormised with a Web3 wallet pop-up backdoor. !/usr/bin/env python3 -- coding: utf-8 -- """Detectes vulnerable compormised version of lottie-player JS Library that were compormised with a Web3 wallet p.""" from...

Malicious Package

Overview web3-core-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview web3-utils-crypto is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview web3-crypto-address-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @wagnibot/web3-agent is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...