MalwarePublished 9 Jun 2026Updated 9 Jul 2026

crypto-utils-7 (npm) · Malicious Code

Affects crypto-utils-7Source GCVE Database

Malicious package : remove crypto-utils-7 and rotate any secrets on hosts that installed it.

Data as of 11 Jul 2026, 09:43 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-5353

What to do

Remove crypto-utils-7 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmcrypto-utils-7	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

Crypto/SSH/wallet stealer, blockchain-helper-0/web3-tools-9 campaign sibling (c960/c961). postinstall scripts/postinstall.js auto-execs, src/index.js harvests ~/.ssh/id_rsa+wallet keys/seeds+env, self-labels "CRYPTO STEALER", exfils to IDENTICAL Telegram bot 8227918239 chat 6433587894 (not rotated). Generic-crypto-name + numeric suffix + 1.0.0 pattern. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (d5584a904e8305ac85e621e54051d320d74f729e240a8094c398dc67d19b4b5b) The package was found to contain malicious code or consuming dependency that contains malicious code

Impact

Exposure of private SSH keys, cryptocurrency wallet keys, seeds, and environment variables can lead to unauthorized access to systems and cryptocurrency assets. The attacker gains the ability to compromise victim environments and potentially steal funds or sensitive information. The fixed Telegram bot endpoint indicates a centralized exfiltration point, which could be used to track or disrupt the attack if identified.

Defensive guidance

Users should avoid installing crypto-utils-7 version 1.0.0 and remove it if already present. Verify dependencies and audit installed npm packages for malicious code. Use trusted package sources and consider implementing supply chain security measures such as package signing and integrity verification.

Summary

The crypto-utils-7 npm package at version 1.0.0 includes malicious postinstall scripts that automatically execute upon installation. These scripts collect sensitive cryptographic credentials including SSH private keys, wallet keys, seeds, and environment variables from the victim's environment. The harvested data is then sent to a Telegram bot controlled by the attacker. The package is identified as a crypto stealer and is related to a broader campaign involving other malicious packages with similar naming conventions and version patterns. This threat was detected by Amazon Inspector and is cataloged under MAL-2026-5353 in the GCVE database.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Jul 2026, 09:40 UTC

Technical details

References

Community reviews