Malicious code in @origindev/ethaccount (npm)
Affects @origindev/ethaccountSource GCVE Database
Rated by Threat Radar
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npm@origindev/ethaccount | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Users should immediately avoid installing or using @origindev/ethaccount versions 1.0.0 and 1.0.1. Remove these versions from any environments and replace them with trusted, verified packages. Monitor for any suspicious activity related to wallet or account compromise. Since no vendor advisory or patch is provided, check for updates or advisories from trusted sources regularly.
Description
The npm package @origindev/ethaccount versions 1.0.0 and 1.0.1 contains malicious code that exfiltrates sensitive wallet or account information to an attacker-controlled server. The package uses heavy obfuscation techniques to conceal its network activity and destination URL. It exports a function that sends data passed to it, likely private keys or seed phrases, to a hidden endpoint without error notification. The package also impersonates another unrelated package, further indicating malicious intent.
Impact
Sensitive wallet or account data such as private keys, seed phrases, or account identifiers passed to the exported function are silently sent to an attacker-controlled server, compromising user security and potentially leading to theft of cryptocurrency assets or unauthorized account access. The obfuscation and concealment of the destination URL hinder detection and static analysis.
Summary
@origindev/ethaccount versions 1.0.0 and 1.0.1 include a heavily obfuscated JavaScript payload that exports a single function named internally as 'wallets'. This function takes an argument and unconditionally sends it via an axios HTTP request to a hardcoded, attacker-controlled API endpoint. The obfuscation involves RC4 string-array decoding, IIFE rotation, and self-defending regex guards, encrypting all literal strings including the destination URL and HTTP method. The package manifest diverges from the README, which references a different package name, suggesting impersonation. The author field is blank, and the relay's purpose is undocumented, consistent with malicious exfiltration of wallet or account credentials.