MalwarePublished 23 Jun 2026Updated 15 Jul 2026

web3-eth-utils (npm) · Malicious Code

Affects web3-eth-utilsSource GCVE Database

Malicious package : remove web3-eth-utils and rotate any secrets on hosts that installed it.

Data as of 15 Jul 2026, 12:52 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6326

What to do

Remove web3-eth-utils from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmweb3-eth-utils	Affected =6.2.8	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package web3-eth-utils version 6.2.8 is a malicious package impersonating the legitimate ethereumjs-util library. It contains injected code that requires a malicious dependency 'assertcore', which executes arbitrary code at install or require time. Systems with this package installed should be considered fully compromised, and all secrets and keys must be rotated. Removal of the package alone may not eliminate the compromise due to potential persistent malicious code.

Impact

Any system with web3-eth-utils@6.2.8 installed or running is fully compromised. The malicious assertcore module executes arbitrary code during package installation or runtime require, potentially allowing attackers full control over the system. All secrets and keys stored on the compromised system are at risk and must be rotated. Simply removing the package does not guarantee removal of all malicious artifacts or backdoors.

Defensive guidance

Remove the web3-eth-utils@6.2.8 package immediately from all systems. Consider all affected systems fully compromised and rotate all secrets and keys from a secure, uncompromised environment. Investigate the system for persistence mechanisms or additional malware beyond the package itself.

Summary

web3-eth-utils@6.2.8 is a malicious npm package that clones the legitimate ethereumjs-util package but injects a side-effect-only require statement for a malicious module 'assertcore' in its compiled Node.js entry point. This require is absent from the source and browser bundles, indicating deliberate code injection after build. When the package is installed or required, it executes arbitrary code from assertcore, granting the attacker install- and require-time code execution on the host system. This compromises the host fully, risking exposure of all stored secrets and keys.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 15 Jul 2026, 12:52 UTC

Technical details

References

Community reviews

Related threats