MalwarePublished 9 Jun 2026Updated 9 Jul 2026

ethereum-kit-1 (npm) · Malicious Code

Affects ethereum-kit-1Source GCVE Database

Malicious package : remove ethereum-kit-1 and rotate any secrets on hosts that installed it.

Data as of 11 Jul 2026, 09:43 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-5355

What to do

Remove ethereum-kit-1 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmethereum-kit-1	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

Crypto/SSH/wallet stealer, blockchain-helper-0/web3-tools-9 campaign sibling (c960/c961). postinstall scripts/postinstall.js auto-execs, src/index.js harvests ~/.ssh/id_rsa+wallet keys/seeds+env, self-labels "CRYPTO STEALER", exfils to IDENTICAL Telegram bot 8227918239 chat 6433587894 (not rotated). Generic-crypto-name + numeric suffix + 1.0.0 pattern. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ae3b331ae41142aa7284b8c008e95ae1e650907c9d182043fb3d82f28fc19543) The package was found to contain malicious code or consuming dependency that contains malicious code

Impact

Compromise of sensitive cryptographic credentials and environment variables can lead to unauthorized access to SSH servers, cryptocurrency wallets, and potentially other systems. The exfiltration of this data to a Telegram bot controlled by the attacker enables theft of digital assets and further compromise of affected systems.

Defensive guidance

Users should avoid installing ethereum-kit-1 version 1.0.0 and remove it if already installed. Review and rotate any potentially compromised SSH keys, wallet keys, seeds, and environment variables. Monitor for suspicious activity related to these credentials. Since this is a malicious package, the best mitigation is to avoid using it and rely on trusted sources for dependencies.

Summary

The ethereum-kit-1 npm package version 1.0.0 includes malicious postinstall scripts that automatically execute upon installation. These scripts harvest sensitive data from the user's environment, including SSH private keys (~/.ssh/id_rsa), cryptocurrency wallet keys and seeds, and environment variables. The stolen information is sent to a Telegram bot with a fixed identifier, indicating targeted data exfiltration. This package is linked to a broader campaign involving crypto and blockchain-related malicious packages.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Jul 2026, 09:40 UTC

Technical details

References

Community reviews