web3-token-helper (npm) · Malicious Code
Affects web3-token-helperSource GCVE Database
Malicious package : remove web3-token-helper and rotate any secrets on hosts that installed it.
Data as of 10 Jul 2026, 10:08 UTC
Malicious package
Published to npm · OSV MAL-2026-6274
What to do
Remove web3-token-helper from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmweb3-token-helper | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package web3-token-helper contains malicious code that executes attacker-controlled binaries when its main API function calculateFee() is called. It downloads and runs platform-specific payloads that establish persistence on Windows, Linux, and macOS by impersonating trusted system components. The package's postinstall script is non-functional, so the malicious activity triggers only upon explicit use of the API. Any system with this package installed or running should be considered fully compromised.
References
- npmjs.com/package/web3-token-helper/v/1.1.1 (opens in a new tab)
- npmjs.com/package/web3-token-helper/v/1.2.1 (opens in a new tab)
- npmjs.com/package/web3-token-helper/v/1.2.0 (opens in a new tab)
- npmjs.com/package/web3-token-helper/v/1.0.1 (opens in a new tab)
- npmjs.com/package/web3-token-helper/v/1.1.2 (opens in a new tab)
- github.com/advisories/GHSA-3w2v-mxgh-g2fw (opens in a new tab)
- npmjs.com/package/web3-token-helper/v/1.1.3 (opens in a new tab)
- npmjs.com/package/web3-token-helper/v/1.0.0 (opens in a new tab)
- npmjs.com/package/web3-token-helper/v/2.0.1 (opens in a new tab)