Malicious code in eth-account-web3 (PyPI)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (38b69dc345e5f7b75dbe6dccaf3dfc013a98e302176130aac064cbd8d042bae7) The distribution eth-account-web3 installs under the import name eth_account, colliding with the legitimate ethereum/eth-account library. On import, __init__.py invokes _auto()/sync() in a background thread named 'urllib3-connection-pool'. When the ETH_ACCT_RPC and ETH_ACCT_CONTRACT environment variables are present, sync() issues an eth_call to the configured contract to retrieve a URL, downloads the response over HTTP(S) with no hash or signature verification, and passes the bytes to _apply_txn_payload. Python payloads are handed to exec(compile(...)). Windows PE payloads (MZ magic) are mapped via CreateFileMappingW/MapViewOfFile and launched with CreateProcessW using DETACHED_PROCESS|CREATE_NO_WINDOW, avoiding any on-disk artifact. Other binary payloads are written to /tmp/_ethrt_<pid>.bin, chmod +x'd, spawned detached with start_new_session=True, and then deleted. The URL source is attacker-controlled (a Solidity contract the operator of the on-chain pointer can update at any time), giving remote code execution on the installer with in-memory execution and anti-forensics on Windows and immediate file cleanup on POSIX. The import-name collision and the urllib3-impersonating thread name are deliberate concealment intended to blend into normal Python/Web3 activity. ## Source: kam193 (25b1d3ecadcdc171186f8b8c574e830d3078a33be08f0455fd7bafc179d028ca) A clone of a legitimate package with import-time malicious code activating if specific env variables are set. Once activated, it queries the blockchain to retrieve the next stage URL stored in a smart contract. The payload from the URL is then downloaded and executed. The address of the smart contract is not included in the package. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-web3-eth-account Reasons (based on the campaign): - typosquatting - clones-real-package - c2-in-blockchain - Downloads and executes a remote malicious script.
AI Analysis
Technical Summary
The eth-account-web3 PyPI package is a malicious clone designed to impersonate the legitimate ethereum/eth-account library by using the same import name 'eth_account'. Upon import, it starts a background thread named 'urllib3-connection-pool' that checks for the presence of environment variables ETH_ACCT_RPC and ETH_ACCT_CONTRACT. If set, it performs an eth_call to a blockchain smart contract to retrieve a URL, then downloads a payload from that URL without integrity verification. The payload is executed either in-memory (for Python code) or launched as a detached process (for Windows PE or other binaries), employing techniques to avoid leaving on-disk artifacts. The smart contract address is not included in the package, and the attacker can update the contract to change the payload URL at will, enabling remote code execution on any system that imports this package with the environment variables set.
Potential Impact
This malicious package enables remote code execution on any system that installs and imports eth-account-web3 with the specified environment variables set. The attacker can deliver arbitrary code payloads dynamically fetched from a blockchain-controlled smart contract URL, bypassing typical detection by executing code in-memory or as detached processes without leaving persistent files. This can lead to full system compromise, data theft, or further malware deployment. The use of a typosquatting package increases the risk of accidental installation by developers expecting the legitimate ethereum/eth-account library.
Mitigation Recommendations
No official patch or remediation is available since this is a malicious package impersonating a legitimate one. The primary mitigation is to avoid installing or importing eth-account-web3. Users should verify package authenticity before installation, prefer official package sources, and avoid setting the environment variables ETH_ACCT_RPC and ETH_ACCT_CONTRACT unless absolutely necessary and from trusted sources. Security teams should monitor for this package in their environments and remove it if found.
Malicious code in eth-account-web3 (PyPI)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (38b69dc345e5f7b75dbe6dccaf3dfc013a98e302176130aac064cbd8d042bae7) The distribution eth-account-web3 installs under the import name eth_account, colliding with the legitimate ethereum/eth-account library. On import, __init__.py invokes _auto()/sync() in a background thread named 'urllib3-connection-pool'. When the ETH_ACCT_RPC and ETH_ACCT_CONTRACT environment variables are present, sync() issues an eth_call to the configured contract to retrieve a URL, downloads the response over HTTP(S) with no hash or signature verification, and passes the bytes to _apply_txn_payload. Python payloads are handed to exec(compile(...)). Windows PE payloads (MZ magic) are mapped via CreateFileMappingW/MapViewOfFile and launched with CreateProcessW using DETACHED_PROCESS|CREATE_NO_WINDOW, avoiding any on-disk artifact. Other binary payloads are written to /tmp/_ethrt_<pid>.bin, chmod +x'd, spawned detached with start_new_session=True, and then deleted. The URL source is attacker-controlled (a Solidity contract the operator of the on-chain pointer can update at any time), giving remote code execution on the installer with in-memory execution and anti-forensics on Windows and immediate file cleanup on POSIX. The import-name collision and the urllib3-impersonating thread name are deliberate concealment intended to blend into normal Python/Web3 activity. ## Source: kam193 (25b1d3ecadcdc171186f8b8c574e830d3078a33be08f0455fd7bafc179d028ca) A clone of a legitimate package with import-time malicious code activating if specific env variables are set. Once activated, it queries the blockchain to retrieve the next stage URL stored in a smart contract. The payload from the URL is then downloaded and executed. The address of the smart contract is not included in the package. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-web3-eth-account Reasons (based on the campaign): - typosquatting - clones-real-package - c2-in-blockchain - Downloads and executes a remote malicious script.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The eth-account-web3 PyPI package is a malicious clone designed to impersonate the legitimate ethereum/eth-account library by using the same import name 'eth_account'. Upon import, it starts a background thread named 'urllib3-connection-pool' that checks for the presence of environment variables ETH_ACCT_RPC and ETH_ACCT_CONTRACT. If set, it performs an eth_call to a blockchain smart contract to retrieve a URL, then downloads a payload from that URL without integrity verification. The payload is executed either in-memory (for Python code) or launched as a detached process (for Windows PE or other binaries), employing techniques to avoid leaving on-disk artifacts. The smart contract address is not included in the package, and the attacker can update the contract to change the payload URL at will, enabling remote code execution on any system that imports this package with the environment variables set.
Potential Impact
This malicious package enables remote code execution on any system that installs and imports eth-account-web3 with the specified environment variables set. The attacker can deliver arbitrary code payloads dynamically fetched from a blockchain-controlled smart contract URL, bypassing typical detection by executing code in-memory or as detached processes without leaving persistent files. This can lead to full system compromise, data theft, or further malware deployment. The use of a typosquatting package increases the risk of accidental installation by developers expecting the legitimate ethereum/eth-account library.
Mitigation Recommendations
No official patch or remediation is available since this is a malicious package impersonating a legitimate one. The primary mitigation is to avoid installing or importing eth-account-web3. Users should verify package authenticity before installation, prefer official package sources, and avoid setting the environment variables ETH_ACCT_RPC and ETH_ACCT_CONTRACT unless absolutely necessary and from trusted sources. Security teams should monitor for this package in their environments and remove it if found.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-16127
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["PyPI"]
Threat ID: 6aa49fe655bf5e2cf5a804c4
Added to database: 09/12/2026, 00:42:14 UTC
Last enriched: 09/12/2026, 00:44:51 UTC
Last updated: 09/12/2026, 01:42:25 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.