Malicious code in web3-tools-9 (npm)
The npm package 'web3-tools-9' version 1.0.0 contains malicious code that acts as a crypto/SSH/wallet stealer. It automatically executes postinstall scripts that harvest sensitive data including SSH private keys (~/.ssh/id_rsa), wallet keys, seeds, and environment variables. The stolen data is exfiltrated to a hardcoded Telegram bot. This package is part of a campaign using generic web3-related names with numeric suffixes. The malicious behavior was confirmed by multiple sources including Amazon Inspector and the OpenSSF Package Analysis project.
AI Analysis
Technical Summary
The 'web3-tools-9' npm package version 1.0.0 contains embedded malicious code that executes automatically after installation. It harvests sensitive credentials such as SSH private keys and cryptocurrency wallet keys/seeds from the victim's environment and exfiltrates this data to a hardcoded Telegram bot endpoint. This package is linked to a known campaign involving similarly named malicious packages and is identified as a crypto stealer. The malicious communication with a domain associated with malicious activity was confirmed by security analysis tools.
Potential Impact
Users who install 'web3-tools-9' version 1.0.0 risk having their SSH private keys, cryptocurrency wallet keys, seeds, and environment variables stolen. This can lead to unauthorized access to systems and cryptocurrency wallets, resulting in potential financial loss and system compromise.
Mitigation Recommendations
No official patch or remediation is available for this malicious package. The recommended mitigation is to avoid installing 'web3-tools-9' version 1.0.0 and remove it immediately if present. Users should verify the integrity and authenticity of npm packages before installation and rely on trusted sources. Monitoring for suspicious postinstall script activity and scanning for known malicious packages can help prevent infection.
Malicious code in web3-tools-9 (npm)
Description
The npm package 'web3-tools-9' version 1.0.0 contains malicious code that acts as a crypto/SSH/wallet stealer. It automatically executes postinstall scripts that harvest sensitive data including SSH private keys (~/.ssh/id_rsa), wallet keys, seeds, and environment variables. The stolen data is exfiltrated to a hardcoded Telegram bot. This package is part of a campaign using generic web3-related names with numeric suffixes. The malicious behavior was confirmed by multiple sources including Amazon Inspector and the OpenSSF Package Analysis project.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'web3-tools-9' npm package version 1.0.0 contains embedded malicious code that executes automatically after installation. It harvests sensitive credentials such as SSH private keys and cryptocurrency wallet keys/seeds from the victim's environment and exfiltrates this data to a hardcoded Telegram bot endpoint. This package is linked to a known campaign involving similarly named malicious packages and is identified as a crypto stealer. The malicious communication with a domain associated with malicious activity was confirmed by security analysis tools.
Potential Impact
Users who install 'web3-tools-9' version 1.0.0 risk having their SSH private keys, cryptocurrency wallet keys, seeds, and environment variables stolen. This can lead to unauthorized access to systems and cryptocurrency wallets, resulting in potential financial loss and system compromise.
Mitigation Recommendations
No official patch or remediation is available for this malicious package. The recommended mitigation is to avoid installing 'web3-tools-9' version 1.0.0 and remove it immediately if present. Users should verify the integrity and authenticity of npm packages before installation and rely on trusted sources. Monitoring for suspicious postinstall script activity and scanning for known malicious packages can help prevent infection.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-5361
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a50ba9168715ace435822ed
Added to database: 07/10/2026, 09:25:37 UTC
Last enriched: 07/10/2026, 10:08:40 UTC
Last updated: 07/26/2026, 10:11:18 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.