web3-tools-9 (npm) · Malicious Code
Affects web3-tools-9Source GCVE Database
Malicious package : remove web3-tools-9 and rotate any secrets on hosts that installed it.
Data as of 10 Jul 2026, 10:08 UTC
Malicious package
Published to npm · OSV MAL-2026-5361
What to do
Remove web3-tools-9 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmweb3-tools-9 | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package 'web3-tools-9' version 1.0.0 contains malicious code that acts as a crypto/SSH/wallet stealer. It automatically executes postinstall scripts that harvest sensitive data including SSH private keys (~/.ssh/id_rsa), wallet keys, seeds, and environment variables. The stolen data is exfiltrated to a hardcoded Telegram bot. This package is part of a campaign using generic web3-related names with numeric suffixes. The malicious behavior was confirmed by multiple sources including Amazon Inspector and the OpenSSF Package Analysis project.