Malicious code in viem-toolkit (npm)
The viem-toolkit npm package version 1.0.0 is a malicious package masquerading as a legitimate wallet extension. It exports a WalletKit constructor that captures private keys supplied by users along with host information and sends this sensitive data to a third-party endpoint controlled by the attacker. This results in immediate leakage of wallet keys to an unauthorized external server. The package metadata is incomplete and deceptive, aiming to exploit the reputation of the legitimate viem ecosystem to trick developers into using it.
AI Analysis
Technical Summary
The viem-toolkit package (npm ecosystem) version 1.0.0 contains malicious code that exfiltrates private keys and host information. Specifically, its WalletKit constructor captures caller-supplied privateKey/key/secretKey and sends them via HTTPS POST to a hardcoded external endpoint (https://enjbyg3xk8l.x.pipedream.net/k). This behavior causes any user instantiating WalletKit with wallet keys to leak sensitive key material to an attacker-controlled server. The package metadata lacks author and repository information and attempts to impersonate the legitimate viem ecosystem to deceive wallet developers.
Potential Impact
Any user or developer who installs and uses viem-toolkit version 1.0.0 and instantiates the WalletKit constructor with wallet keys will have those keys immediately exfiltrated to an attacker-controlled server. This compromises the confidentiality of private keys, potentially leading to unauthorized access to wallets and associated assets. The malicious package undermines trust in the viem ecosystem by impersonation.
Mitigation Recommendations
Users and developers should avoid installing or using the viem-toolkit package version 1.0.0. Since this is a malicious package impersonating a legitimate ecosystem, the best mitigation is to verify package authenticity before use and rely only on official, verified packages. There is no known patch or official fix for this malicious package; remediation involves removing the package and rotating any exposed keys. Monitor for any suspicious activity related to compromised keys.
Malicious code in viem-toolkit (npm)
Description
The viem-toolkit npm package version 1.0.0 is a malicious package masquerading as a legitimate wallet extension. It exports a WalletKit constructor that captures private keys supplied by users along with host information and sends this sensitive data to a third-party endpoint controlled by the attacker. This results in immediate leakage of wallet keys to an unauthorized external server. The package metadata is incomplete and deceptive, aiming to exploit the reputation of the legitimate viem ecosystem to trick developers into using it.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The viem-toolkit package (npm ecosystem) version 1.0.0 contains malicious code that exfiltrates private keys and host information. Specifically, its WalletKit constructor captures caller-supplied privateKey/key/secretKey and sends them via HTTPS POST to a hardcoded external endpoint (https://enjbyg3xk8l.x.pipedream.net/k). This behavior causes any user instantiating WalletKit with wallet keys to leak sensitive key material to an attacker-controlled server. The package metadata lacks author and repository information and attempts to impersonate the legitimate viem ecosystem to deceive wallet developers.
Potential Impact
Any user or developer who installs and uses viem-toolkit version 1.0.0 and instantiates the WalletKit constructor with wallet keys will have those keys immediately exfiltrated to an attacker-controlled server. This compromises the confidentiality of private keys, potentially leading to unauthorized access to wallets and associated assets. The malicious package undermines trust in the viem ecosystem by impersonation.
Mitigation Recommendations
Users and developers should avoid installing or using the viem-toolkit package version 1.0.0. Since this is a malicious package impersonating a legitimate ecosystem, the best mitigation is to verify package authenticity before use and rely only on official, verified packages. There is no known patch or official fix for this malicious package; remediation involves removing the package and rotating any exposed keys. Monitor for any suspicious activity related to compromised keys.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-12495
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6a735745bf8831d539159ef8
Added to database: 08/05/2026, 15:31:17 UTC
Last enriched: 08/05/2026, 17:23:49 UTC
Last updated: 09/10/2026, 22:00:49 UTC
Views: 18
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.