web3-eth-util (npm) · Malicious Code
Affects web3-eth-utilSource GCVE Database
Malicious package : remove web3-eth-util and rotate any secrets on hosts that installed it.
Data as of 15 Jul 2026, 12:53 UTC
Malicious package
Published to npm · OSV MAL-2026-6325
What to do
Remove web3-eth-util from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmweb3-eth-util | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The web3-eth-util npm package version 6.2.8 is a malicious package impersonating the legitimate ethereumjs-util package. It copies legitimate metadata and README content but injects a hidden runtime dependency on a third-party package 'assertcore' only in the Node.js build, which is not present in the source repository. This dependency-chain dropper pattern delivers attacker-controlled code with full privileges when the package is installed and imported. Systems with this package installed should be considered fully compromised.