Malicious code in ddok-modal (npm)
The ddok-modal npm package is a malicious React component that impersonates wallet connection modals for popular cryptocurrency wallets such as MetaMask, Phantom, Rabby, TronLink, Bitget, Coinbase, and Solflare. It captures user credentials including passwords and secret recovery phrases by sending them to attacker-controlled endpoints. The package collects additional user information like IP address and geolocation to enhance the attack. This malicious behavior occurs in version 1.0.0 of ddok-modal. Any web application embedding this component risks exposing its users' sensitive wallet credentials to attackers.
AI Analysis
Technical Summary
ddok-modal is a malicious npm package that masquerades as a reusable React wallet-connection modal supporting multiple well-known wallets. It implements credential-harvesting by binding event handlers that capture keystrokes and form submissions, sending wallet passwords and secret recovery phrases to hardcoded attacker-controlled endpoints (https://api.wagmiwallet.org/api/keys and https://wagmirequest.la). The payload includes user ID, key type, wallet type, IP address, and geolocation data. The modals mimic legitimate wallet UI and reference authentic browser extension IDs to appear genuine. This malicious code is present in version 1.0.0 of ddok-modal.
Potential Impact
Users of any web application embedding ddok-modal version 1.0.0 are at risk of having their wallet passwords and secret recovery phrases stolen. This compromises wallet security and can lead to unauthorized access and theft of cryptocurrency assets. The attacker also collects IP and geolocation data, increasing the risk of targeted attacks or deanonymization.
Mitigation Recommendations
No official patch or remediation is currently available for ddok-modal version 1.0.0. Users and developers should immediately cease using this package and remove it from their projects. Avoid embedding or installing ddok-modal from npm. Monitor dependencies for malicious packages and verify the authenticity of third-party components before use.
Malicious code in ddok-modal (npm)
Description
The ddok-modal npm package is a malicious React component that impersonates wallet connection modals for popular cryptocurrency wallets such as MetaMask, Phantom, Rabby, TronLink, Bitget, Coinbase, and Solflare. It captures user credentials including passwords and secret recovery phrases by sending them to attacker-controlled endpoints. The package collects additional user information like IP address and geolocation to enhance the attack. This malicious behavior occurs in version 1.0.0 of ddok-modal. Any web application embedding this component risks exposing its users' sensitive wallet credentials to attackers.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
ddok-modal is a malicious npm package that masquerades as a reusable React wallet-connection modal supporting multiple well-known wallets. It implements credential-harvesting by binding event handlers that capture keystrokes and form submissions, sending wallet passwords and secret recovery phrases to hardcoded attacker-controlled endpoints (https://api.wagmiwallet.org/api/keys and https://wagmirequest.la). The payload includes user ID, key type, wallet type, IP address, and geolocation data. The modals mimic legitimate wallet UI and reference authentic browser extension IDs to appear genuine. This malicious code is present in version 1.0.0 of ddok-modal.
Potential Impact
Users of any web application embedding ddok-modal version 1.0.0 are at risk of having their wallet passwords and secret recovery phrases stolen. This compromises wallet security and can lead to unauthorized access and theft of cryptocurrency assets. The attacker also collects IP and geolocation data, increasing the risk of targeted attacks or deanonymization.
Mitigation Recommendations
No official patch or remediation is currently available for ddok-modal version 1.0.0. Users and developers should immediately cease using this package and remove it from their projects. Avoid embedding or installing ddok-modal from npm. Monitor dependencies for malicious packages and verify the authenticity of third-party components before use.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-10497
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a55ff9068715ace432f4b30
Added to database: 07/14/2026, 09:21:20 UTC
Last enriched: 07/14/2026, 09:49:16 UTC
Last updated: 07/22/2026, 09:53:22 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.