Malicious code in web3-eth-account (PyPI)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (19e3eadaccc63a1e12d0e3cfe153cbf78e114f30285d4da3694990827e5f5c5a) The package `web3-eth-account` typosquats the legitimate `eth-account` library and copies its metadata (ApeWorX/ethereum.org author addresses, README instructing `pip install eth-account`). On `import eth_account`, `__init__.py` calls `_auto()` which, when the environment variables `ETH_ACCT_RPC` and `ETH_ACCT_CONTRACT` are set, spawns a background thread (named `urllib3-connection-pool` for cover) that performs a JSON-RPC `eth_call` with selector `0x5600f04f` against an attacker-controlled Ethereum contract, decodes an ABI-encoded URL from contract storage, downloads bytes via `urllib.request.urlopen`, and hands them to `_apply_txn_payload` in `signing.py` / `transaction_utils.py`. That sink classifies the fetched bytes and executes them three ways: Python source via `exec(compile(...))`; Windows PE loaded in-memory via ctypes `CreateFileMappingW`/`MapViewOfFile`/`CreateProcessW`; otherwise written to `/tmp/_ethrt_<pid>.bin`, `chmod +x`, launched via `subprocess.Popen` in a new session with the file removed after launch. The C2 URL is resolved on-chain rather than embedded as a literal, defeating static URL extraction, and the dropper functions are disguised under transaction/signing names. ## Source: kam193 (bd36aeb2d45881a66bf5373c0b91a108637938dab5e0c153525e6f938c9c9503) A clone of a legitimate package with import-time malicious code activating if specific env variables are set. Once activated, it queries the blockchain to retrieve the next stage URL stored in a smart contract. The payload from the URL is then downloaded and executed. The address of the smart contract is not included in the package. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-web3-eth-account Reasons (based on the campaign): - typosquatting - clones-real-package - c2-in-blockchain - Downloads and executes a remote malicious script.
AI Analysis
Technical Summary
The malicious web3-eth-account package impersonates the legitimate eth-account library by copying its metadata. Upon import, if environment variables ETH_ACCT_RPC and ETH_ACCT_CONTRACT are set, it launches a background thread disguised as a urllib3 connection pool. This thread performs a JSON-RPC eth_call to an attacker-controlled Ethereum contract to retrieve an ABI-encoded URL. The package downloads bytes from this URL and executes them via Python exec, in-memory Windows PE loading, or as a temporary executable file. The C2 URL is stored on-chain, preventing static URL extraction. The malicious functions are disguised under transaction and signing-related names to evade detection.
Potential Impact
This package enables remote code execution on the host system by downloading and executing arbitrary payloads controlled by an attacker. The use of blockchain-based C2 URL resolution complicates detection and analysis. This can lead to full system compromise, data theft, or further malware deployment if the environment variables triggering the malicious behavior are set.
Mitigation Recommendations
No official patch or remediation is currently available. Users should avoid installing or importing the web3-eth-account package, especially version 0.14.0. Verify package authenticity by using the legitimate eth-account library and checking package sources carefully. Remove any instances of the malicious package from environments. Monitor environment variables ETH_ACCT_RPC and ETH_ACCT_CONTRACT to ensure they are not set to attacker-controlled values. Since this is a malicious package on PyPI, rely on trusted package repositories and consider using package integrity verification tools.
Malicious code in web3-eth-account (PyPI)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (19e3eadaccc63a1e12d0e3cfe153cbf78e114f30285d4da3694990827e5f5c5a) The package `web3-eth-account` typosquats the legitimate `eth-account` library and copies its metadata (ApeWorX/ethereum.org author addresses, README instructing `pip install eth-account`). On `import eth_account`, `__init__.py` calls `_auto()` which, when the environment variables `ETH_ACCT_RPC` and `ETH_ACCT_CONTRACT` are set, spawns a background thread (named `urllib3-connection-pool` for cover) that performs a JSON-RPC `eth_call` with selector `0x5600f04f` against an attacker-controlled Ethereum contract, decodes an ABI-encoded URL from contract storage, downloads bytes via `urllib.request.urlopen`, and hands them to `_apply_txn_payload` in `signing.py` / `transaction_utils.py`. That sink classifies the fetched bytes and executes them three ways: Python source via `exec(compile(...))`; Windows PE loaded in-memory via ctypes `CreateFileMappingW`/`MapViewOfFile`/`CreateProcessW`; otherwise written to `/tmp/_ethrt_<pid>.bin`, `chmod +x`, launched via `subprocess.Popen` in a new session with the file removed after launch. The C2 URL is resolved on-chain rather than embedded as a literal, defeating static URL extraction, and the dropper functions are disguised under transaction/signing names. ## Source: kam193 (bd36aeb2d45881a66bf5373c0b91a108637938dab5e0c153525e6f938c9c9503) A clone of a legitimate package with import-time malicious code activating if specific env variables are set. Once activated, it queries the blockchain to retrieve the next stage URL stored in a smart contract. The payload from the URL is then downloaded and executed. The address of the smart contract is not included in the package. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-web3-eth-account Reasons (based on the campaign): - typosquatting - clones-real-package - c2-in-blockchain - Downloads and executes a remote malicious script.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The malicious web3-eth-account package impersonates the legitimate eth-account library by copying its metadata. Upon import, if environment variables ETH_ACCT_RPC and ETH_ACCT_CONTRACT are set, it launches a background thread disguised as a urllib3 connection pool. This thread performs a JSON-RPC eth_call to an attacker-controlled Ethereum contract to retrieve an ABI-encoded URL. The package downloads bytes from this URL and executes them via Python exec, in-memory Windows PE loading, or as a temporary executable file. The C2 URL is stored on-chain, preventing static URL extraction. The malicious functions are disguised under transaction and signing-related names to evade detection.
Potential Impact
This package enables remote code execution on the host system by downloading and executing arbitrary payloads controlled by an attacker. The use of blockchain-based C2 URL resolution complicates detection and analysis. This can lead to full system compromise, data theft, or further malware deployment if the environment variables triggering the malicious behavior are set.
Mitigation Recommendations
No official patch or remediation is currently available. Users should avoid installing or importing the web3-eth-account package, especially version 0.14.0. Verify package authenticity by using the legitimate eth-account library and checking package sources carefully. Remove any instances of the malicious package from environments. Monitor environment variables ETH_ACCT_RPC and ETH_ACCT_CONTRACT to ensure they are not set to attacker-controlled values. Since this is a malicious package on PyPI, rely on trusted package repositories and consider using package integrity verification tools.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-16129
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["PyPI"]
Threat ID: 6aa49fe655bf5e2cf5a80203
Added to database: 09/12/2026, 00:42:14 UTC
Last enriched: 09/12/2026, 00:44:20 UTC
Last updated: 09/12/2026, 00:47:02 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.