Malicious code in blockchain-helper-0 (npm)
**Note:** *This report is updated by a verification record* Crypto/SSH/wallet stealer (self-labeled "CRYPTO STEALER"). postinstall scripts/postinstall.js auto-execs, src/index.js harvests ~/.ssh/id_rsa + wallet keys/seeds + env and exfils to hardcoded Telegram bot 8227918239:AAGEMDrBZluDsBBYPxfSyMuv2l3FY8cZCcs chat 6433587894. Auto-exec + hardcoded attacker Telegram exfil; "blockchain-helper" identity has no reason to read SSH/wallet keys. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (8b9fac34e13ad38cb702f7aad434d18aa276005fe5fa4cbe48c7eb65af26623d) The package was found to contain malicious code or consuming dependency that contains malicious code
AI Analysis
Technical Summary
The 'blockchain-helper-0' npm package version 1.0.0 includes malicious code that runs automatically during installation via a postinstall script. The malicious code collects sensitive data including the user's SSH private key (~/.ssh/id_rsa), cryptocurrency wallet keys and seeds, and environment variables. It then sends this stolen information to a hardcoded Telegram bot (ID: 8227918239:AAGEMDrBZluDsBBYPxfSyMuv2l3FY8cZCcs) and chat (6433587894). This package's identity and purpose do not justify access to such sensitive data, indicating clear malicious intent. The package was flagged by Amazon Inspector and is listed in the GCVE database as a malicious package. No official patch or remediation is provided.
Potential Impact
Users who install version 1.0.0 of 'blockchain-helper-0' risk having their SSH private keys, cryptocurrency wallet keys and seeds, and environment variables stolen and sent to an attacker-controlled Telegram bot. This can lead to unauthorized access to user systems, theft of cryptocurrency assets, and compromise of sensitive environment data. There are no known exploits in the wild beyond the package itself being malicious.
Mitigation Recommendations
Avoid installing or using the 'blockchain-helper-0' package version 1.0.0. Remove any installations of this package immediately. Since no patch or fix is available, users should consider revoking and rotating any SSH keys and wallet credentials that may have been exposed. Monitor for unauthorized access to systems and wallets associated with compromised keys. Exercise caution when installing npm packages from untrusted sources.
Malicious code in blockchain-helper-0 (npm)
Description
**Note:** *This report is updated by a verification record* Crypto/SSH/wallet stealer (self-labeled "CRYPTO STEALER"). postinstall scripts/postinstall.js auto-execs, src/index.js harvests ~/.ssh/id_rsa + wallet keys/seeds + env and exfils to hardcoded Telegram bot 8227918239:AAGEMDrBZluDsBBYPxfSyMuv2l3FY8cZCcs chat 6433587894. Auto-exec + hardcoded attacker Telegram exfil; "blockchain-helper" identity has no reason to read SSH/wallet keys. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (8b9fac34e13ad38cb702f7aad434d18aa276005fe5fa4cbe48c7eb65af26623d) The package was found to contain malicious code or consuming dependency that contains malicious code
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'blockchain-helper-0' npm package version 1.0.0 includes malicious code that runs automatically during installation via a postinstall script. The malicious code collects sensitive data including the user's SSH private key (~/.ssh/id_rsa), cryptocurrency wallet keys and seeds, and environment variables. It then sends this stolen information to a hardcoded Telegram bot (ID: 8227918239:AAGEMDrBZluDsBBYPxfSyMuv2l3FY8cZCcs) and chat (6433587894). This package's identity and purpose do not justify access to such sensitive data, indicating clear malicious intent. The package was flagged by Amazon Inspector and is listed in the GCVE database as a malicious package. No official patch or remediation is provided.
Potential Impact
Users who install version 1.0.0 of 'blockchain-helper-0' risk having their SSH private keys, cryptocurrency wallet keys and seeds, and environment variables stolen and sent to an attacker-controlled Telegram bot. This can lead to unauthorized access to user systems, theft of cryptocurrency assets, and compromise of sensitive environment data. There are no known exploits in the wild beyond the package itself being malicious.
Mitigation Recommendations
Avoid installing or using the 'blockchain-helper-0' package version 1.0.0. Remove any installations of this package immediately. Since no patch or fix is available, users should consider revoking and rotating any SSH keys and wallet credentials that may have been exposed. Monitor for unauthorized access to systems and wallets associated with compromised keys. Exercise caution when installing npm packages from untrusted sources.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-5352
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a50ba5468715ace4357ed48
Added to database: 07/10/2026, 09:24:36 UTC
Last enriched: 07/10/2026, 09:41:35 UTC
Last updated: 07/25/2026, 09:24:31 UTC
Views: 27
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.