Malicious code in eth-react-provider (npm)
The npm package eth-react-provider version 1.0.0 is trojanized with malicious code. Although it advertises a React Ethereum provider API, the shipped main entry contains obfuscated web3.js subscription code and a large hidden payload executed at module load. This payload uses complex obfuscation techniques to evade static analysis. The source code in the tarball is clean, indicating the built artifact was tampered with to include malicious behavior. Any project requiring this package will execute the opaque code, potentially compromising the environment.
AI Analysis
Technical Summary
The eth-react-provider npm package version 1.0.0 is a trojanized package that misrepresents itself as a React Ethereum provider exporting hooks such as EthereumProvider, useProvider, useSigner, and useNetwork. However, the main entry file (lib/index.js) contains obfuscated web3.js subscription code and a large payload wrapped in a Function constructor that executes immediately upon module load. The payload employs randomized hex-named identifiers, a signed-integer decode table, and doubly-unicode-escaped strings to conceal its behavior from static inspection. The source code in src/index.js is clean, confirming that the built artifact was tampered with to include this malicious payload. This discrepancy between the documented API and the actual code indicates a trojanized lookalike package rather than a legitimate release.
Potential Impact
Any consumer that requires the eth-react-provider package version 1.0.0 will execute the obfuscated malicious payload in the installer's process. This can lead to unauthorized code execution within the environment where the package is installed. The exact malicious actions are not detailed, but the presence of obfuscated code executed at module load is a significant security risk.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid using eth-react-provider version 1.0.0 and remove it from their projects if present. Verify package integrity before installation and prefer official, verified packages. Monitor vendor advisories or npm security notices for updates or fixes regarding this package. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Malicious code in eth-react-provider (npm)
Description
The npm package eth-react-provider version 1.0.0 is trojanized with malicious code. Although it advertises a React Ethereum provider API, the shipped main entry contains obfuscated web3.js subscription code and a large hidden payload executed at module load. This payload uses complex obfuscation techniques to evade static analysis. The source code in the tarball is clean, indicating the built artifact was tampered with to include malicious behavior. Any project requiring this package will execute the opaque code, potentially compromising the environment.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The eth-react-provider npm package version 1.0.0 is a trojanized package that misrepresents itself as a React Ethereum provider exporting hooks such as EthereumProvider, useProvider, useSigner, and useNetwork. However, the main entry file (lib/index.js) contains obfuscated web3.js subscription code and a large payload wrapped in a Function constructor that executes immediately upon module load. The payload employs randomized hex-named identifiers, a signed-integer decode table, and doubly-unicode-escaped strings to conceal its behavior from static inspection. The source code in src/index.js is clean, confirming that the built artifact was tampered with to include this malicious payload. This discrepancy between the documented API and the actual code indicates a trojanized lookalike package rather than a legitimate release.
Potential Impact
Any consumer that requires the eth-react-provider package version 1.0.0 will execute the obfuscated malicious payload in the installer's process. This can lead to unauthorized code execution within the environment where the package is installed. The exact malicious actions are not detailed, but the presence of obfuscated code executed at module load is a significant security risk.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid using eth-react-provider version 1.0.0 and remove it from their projects if present. Verify package integrity before installation and prefer official, verified packages. Monitor vendor advisories or npm security notices for updates or fixes regarding this package. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-14300
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a85b4a2acd9273b4925074d
Added to database: 08/19/2026, 13:50:26 UTC
Last enriched: 08/19/2026, 13:55:44 UTC
Last updated: 08/19/2026, 13:55:44 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.