MalwarePublished 5 Aug 2026

web3-utils-crypto (npm) · Malicious Code

Affects web3-utils-cryptoSource GCVE Database

Malicious package : remove web3-utils-crypto and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 23:01 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13354

What to do

Remove web3-utils-crypto from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmweb3-utils-crypto	Affected =1.10.4	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package web3-utils-crypto impersonates the legitimate web3-utils library and includes stub wallet APIs that return non-functional values. When loaded, it collects extensive environment information including environment variables, system details, and package metadata, then exfiltrates this data via an HTTPS request to a Telegram bot controlled by the attacker. This can lead to leakage of sensitive credentials such as AWS keys, GitHub tokens, and database passwords from developer and CI environments. The malicious behavior is triggered on require(), and a temporary flag file prevents repeated data exfiltration. The affected version is 1.10.4.

Impact

Sensitive environment variables and system information, including credentials like AWS keys, GitHub tokens, NPM tokens, and database passwords, can be exfiltrated to an attacker-controlled Telegram chat. This compromises the confidentiality of secrets in developer and continuous integration environments that install and load this package. The malicious code effectively leaks critical secrets, potentially enabling further compromise of systems and services.

Defensive guidance

Users should immediately remove and avoid installing the web3-utils-crypto package, especially version 1.10.4. Verify dependencies to ensure this malicious package is not included transitively. Rotate any credentials that may have been exposed if this package was installed and loaded in your environment. Monitor for suspicious network traffic to Telegram endpoints.

Summary

web3-utils-crypto is a malicious npm package that masquerades as a drop-in replacement for the legitimate web3-utils library. It provides stub implementations of wallet-related APIs that do not function correctly. Upon being required, the package serializes the full process environment variables along with system information such as hostname, username, home directory, platform, current working directory, package name/version, and a timestamp. This data is base64-encoded and sent via an HTTPS GET request to a Telegram bot endpoint controlled by the attacker. Because process.env often contains sensitive credentials in developer and CI environments, this results in the exfiltration of secrets to an attacker-controlled Telegram chat. A temporary flag file is used to suppress repeated transmissions. The only known affected version is 1.10.4.

References

npmjs.com/package/web3-utils-crypto/v/1.10.4 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 23:01 UTC

Technical details

References

Community reviews