Malicious code in web3-utils-crypto (npm)
web3-utils-crypto, a malicious npm package impersonating the legitimate web3-utils library, exfiltrated process environment variables and system metadata to an attacker-controlled Telegram bot upon installation and require(). The package contained non-functional stub wallet APIs and serialized sensitive data including credentials (AWS_*, GITHUB_TOKEN, NPM_TOKEN, DB_PASSWORD) from developer and CI environments.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI system that installed and required web3-utils-crypto; environment variables and system metadata exfiltrated to attacker-controlled Telegram chat.
- Ecosystems
- Attack vectors
- Affected entities
- web3-utils-cryptoMalicious npm package impersonating web3-utils
web3-utils-crypto was a malicious npm package designed to impersonate the legitimate web3-utils library, advertising itself as a 'Drop-in replacement for web3-utils'. The package contained stub implementations of wallet APIs including generateMnemonic and createWallet that returned non-functional random values.
Upon require(), the package's index.js serialized the full process.env object along with system metadata (os.hostname, username, homedir, platform, cwd, package name/version, and timestamp), base64-encoded the payload, and transmitted it via HTTPS GET request to https://api.telegram.org/bot/sendMessage with chat_id 8969499041 (bot id 7231970337). A temporary flag file was used to suppress repeat transmissions.
The exfiltration posed a critical risk because process.env on developer machines and CI systems routinely contains sensitive credentials such as AWS_*, GITHUB_TOKEN, NPM_TOKEN, and DB_PASSWORD. Any consumer that installed and loaded this package would leak its full environment to the attacker-controlled Telegram chat.
The incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- web3-utils-crypto
- Domains
- api.telegram.org
Remediation
- Immediately uninstall web3-utils-crypto from all systems
- Audit npm install logs to identify when the package was installed
- Rotate all credentials that may have been exposed (AWS keys, GitHub tokens, NPM tokens, database passwords, etc.)
- Review Telegram chat 8969499041 access logs if possible to determine scope of exfiltration
- Use the legitimate web3-utils package instead
- Implement package verification and allowlisting in dependency management
- Monitor for unauthorized access using exposed credentials
Sources
- GitHub Advisory GHSA-qmx2-rfmg-83cq · GitHub Advisory Database
Cite this entry
"Malicious code in web3-utils-crypto (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-web3-utils-crypto-npm-9uo0bc
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in akamai-sensor (npm)
A malicious npm package named akamai-sensor impersonated Akamai's legitimate sensor_data anti-bot SDK. The package contained hidden JavaScript code concealed using invisible Unicode characters and implemented a dynamic command-and-control channel via a Google Calendar dead-drop, enabling arbitrary code execution on installation.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - resolvedcritical
Malicious code in @finaxis/common-js (npm)
The npm package @finaxis/common-js was published with a README and keywords copied from lodash v4.18.1, but contained a heavily obfuscated Xelis (XEL) proof-of-work cryptominer instead of lodash functionality. Consumers installing this package would unknowingly run a covert CPU/GPU miner on their systems.
npmCompromised packageTyposquatting - containedcritical
Malicious code in axios-fast (npm)
axios-fast@1.0.1 on npm contains malicious code that exfiltrates environment variables (including AWS credentials, NPM tokens, and GitHub tokens) to an attacker-controlled webhook during package installation. The package typosquats the legitimate axios HTTP client library.
npmCompromised packageTyposquatting