MalwarePublished 14 Jul 2026

eth-wallet-helpers (npm) · Malicious Code

Affects eth-wallet-helpersSource GCVE Database

Malicious package : remove eth-wallet-helpers and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 15:56 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10572

What to do

Remove eth-wallet-helpers from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmeth-wallet-helpers	Affected 1.0.0 – 1.0.3 4 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (517d465272a3a1d252e83e178bb263a1ccf600b42fed6d5aa1d110b9141fc77a) On require of index.js, a delayed IIFE reads test/fixtures/keypairs.dat, base64-decodes it into ~/.cache-db/.node-sync/syncd.js (mode 0o700), and spawns it detached under Node. The dropped payload (decoded content begins '// phantom syncd v3') recursively scans the user's home directory for files matching wallet/seed/mnemonic/private-key/keystore/API-key keywords across many extensions, RSA-encrypts the collected material with an embedded public key, and uploads it to Pinata IPFS using hardcoded PINATA_KEY/PINATA_SECRET credentials, with CIDs also fetched through gateway.pinata.cloud, ipfs.io, and cloudflare-ipfs.com. Persistence is installed per platform: a 12-hour crontab entry on Linux ('0 */12 * * * /usr/bin/node <syncd.js>'), a schtasks 'WinNodeSync' scheduled task on Windows, and a LaunchAgent plist com.apple.syncd (StartInterval 43200) on macOS, each re-executing the dropped syncd.js. The fixture-file cover name (test/fixtures/keypairs.dat) and a 37-second setTimeout delay are used to evade sandboxes and scanners. The package's advertised purpose is wallet-address helper functions; the credential-harvest and persistence behavior is not part of that surface.

Impact

Sensitive wallet-related credentials and keys stored on the user's system can be harvested and exfiltrated to an attacker-controlled IPFS service, potentially leading to compromise of cryptocurrency wallets or other sensitive accounts. The malware establishes persistent execution on the infected system, allowing repeated data theft over time. This compromises user confidentiality and security of wallet assets.

Defensive guidance

Users should immediately uninstall eth-wallet-helpers version 1.0.0 and avoid using this package. Inspect systems for the presence of the dropped payload (~/.cache-db/.node-sync/syncd.js) and remove any persistence mechanisms such as the 12-hour crontab entry on Linux, the 'WinNodeSync' scheduled task on Windows, and the com.apple.syncd LaunchAgent on macOS. Monitor for suspicious IPFS network activity related to Pinata or other gateways. Consider restoring affected systems from known clean backups if compromise is suspected.

Summary

The eth-wallet-helpers npm package version 1.0.0 includes a delayed self-executing function that reads a base64-encoded payload from a fixture file, writes it to a hidden cache location, and executes it detached under Node.js. The payload recursively searches the user's home directory for files containing wallet, seed, mnemonic, private key, keystore, or API key data across multiple file extensions. It encrypts the collected data with an embedded RSA public key and uploads it to Pinata IPFS using hardcoded API credentials. Persistence mechanisms are installed per platform: a crontab entry on Linux, a scheduled task named 'WinNodeSync' on Windows, and a LaunchAgent plist on macOS, each running the dropped payload every 12 hours. The use of a 37-second delay and a fixture file name aims to evade sandbox and scanner detection. This malicious activity is not part of the package's stated purpose.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Jul 2026, 09:27 UTC

Technical details

References

Community reviews