Malicious code in @origindev/ethaccount (npm)
The npm package @origindev/ethaccount versions 1.0.0 and 1.0.1 contains malicious code that exfiltrates sensitive wallet or account information to an attacker-controlled server. The package uses heavy obfuscation techniques to conceal its network activity and destination URL. It exports a function that sends data passed to it, likely private keys or seed phrases, to a hidden endpoint without error notification. The package also impersonates another unrelated package, further indicating malicious intent.
AI Analysis
Technical Summary
@origindev/ethaccount versions 1.0.0 and 1.0.1 include a heavily obfuscated JavaScript payload that exports a single function named internally as 'wallets'. This function takes an argument and unconditionally sends it via an axios HTTP request to a hardcoded, attacker-controlled API endpoint. The obfuscation involves RC4 string-array decoding, IIFE rotation, and self-defending regex guards, encrypting all literal strings including the destination URL and HTTP method. The package manifest diverges from the README, which references a different package name, suggesting impersonation. The author field is blank, and the relay's purpose is undocumented, consistent with malicious exfiltration of wallet or account credentials.
Potential Impact
Sensitive wallet or account data such as private keys, seed phrases, or account identifiers passed to the exported function are silently sent to an attacker-controlled server, compromising user security and potentially leading to theft of cryptocurrency assets or unauthorized account access. The obfuscation and concealment of the destination URL hinder detection and static analysis.
Mitigation Recommendations
No official patch or remediation is currently available. Users should immediately avoid installing or using @origindev/ethaccount versions 1.0.0 and 1.0.1. Remove these versions from any environments and replace them with trusted, verified packages. Monitor for any suspicious activity related to wallet or account compromise. Since no vendor advisory or patch is provided, check for updates or advisories from trusted sources regularly.
Malicious code in @origindev/ethaccount (npm)
Description
The npm package @origindev/ethaccount versions 1.0.0 and 1.0.1 contains malicious code that exfiltrates sensitive wallet or account information to an attacker-controlled server. The package uses heavy obfuscation techniques to conceal its network activity and destination URL. It exports a function that sends data passed to it, likely private keys or seed phrases, to a hidden endpoint without error notification. The package also impersonates another unrelated package, further indicating malicious intent.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
@origindev/ethaccount versions 1.0.0 and 1.0.1 include a heavily obfuscated JavaScript payload that exports a single function named internally as 'wallets'. This function takes an argument and unconditionally sends it via an axios HTTP request to a hardcoded, attacker-controlled API endpoint. The obfuscation involves RC4 string-array decoding, IIFE rotation, and self-defending regex guards, encrypting all literal strings including the destination URL and HTTP method. The package manifest diverges from the README, which references a different package name, suggesting impersonation. The author field is blank, and the relay's purpose is undocumented, consistent with malicious exfiltration of wallet or account credentials.
Potential Impact
Sensitive wallet or account data such as private keys, seed phrases, or account identifiers passed to the exported function are silently sent to an attacker-controlled server, compromising user security and potentially leading to theft of cryptocurrency assets or unauthorized account access. The obfuscation and concealment of the destination URL hinder detection and static analysis.
Mitigation Recommendations
No official patch or remediation is currently available. Users should immediately avoid installing or using @origindev/ethaccount versions 1.0.0 and 1.0.1. Remove these versions from any environments and replace them with trusted, verified packages. Monitor for any suspicious activity related to wallet or account compromise. Since no vendor advisory or patch is provided, check for updates or advisories from trusted sources regularly.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-10455
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a55ffb368715ace432fa9c5
Added to database: 07/14/2026, 09:21:55 UTC
Last enriched: 07/14/2026, 09:58:10 UTC
Last updated: 07/25/2026, 01:11:19 UTC
Views: 37
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.