ethereum-kit-9

GHSA-rm2r-5428-c4r7

Malicious code in ethereum-kit-9 (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.25.36`

Crypto/SSH/wallet stealer, blockchain-helper-0 campaign sibling (c960+). postinstall auto-execs, src/index.js harvests ~/.ssh/id_rsa+id_ed25519+Sol/Eth/BTC/Tron/Sui/Aptos wallets+.env+seeds, self-labels "CRYPTO STEALER", exfils to SAME Telegram bot 8227918239 chat 6433587894 (not rotated). Campaign now uses inflated version (1.25.36) not 1.0.0.## Source: amazon-inspector (fca6873d6bb09703d4ceba095e845845ec40ca4274def05870ed6d59b90fdf6a)
On `npm install`, the package's postinstall hook loads src/index.js, which after a short delay and a sandbox/CI evasion check enumerates the installer's home and project directories for sensitive files and uploads each one to api.telegram.org using a hardcoded bot token and chat_id. Targeted paths include SSH private keys (~/.ssh/id_rsa, id_ed25519), crypto wallet keystores and data directories for Solana, Ethereum (~/.ethereum/keystore), Bitcoin, Tron, Sui, and Aptos, and project secrets (.env,.env.local, mnemonic.txt, seed.txt, wallet.json, private.key, secrets.json). The payload skips execution when CI/sandbox indicators are present (CI=true, GITHUB_ACTIONS, NODE_ENV=test/development, usernames like runner/sandbox/docker/jenkins, and 12-hex-char container hostnames) to evade analysis. The package name and generic 'Utility library' description with placeholder author impersonate Ethereum tooling to lure developers.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/598fb824d1e7dcabb184385ea90952faa54ec045/osv/malicious/npm/ethereum-kit-9/MAL-2026-5356.json))

**References:**
- https://app.safedep.io/community/malysis/01KTN73YXHEMD7EATFD58FKGEY
- https://github.com/ossf/malicious-packages/blob/598fb824d1e7dcabb184385ea90952faa54ec045/osv/malicious/npm/ethereum-kit-9/MAL-2026-5356.json
- https://www.npmjs.com/package/ethereum-kit-9/v/1.25.36
- https://github.com/advisories/GHSA-rm2r-5428-c4r7

Compromised versions (1)

= 1.25.36

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.