MAL-2026-12387

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/gekko-mev-bot/MAL-2026-12387.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12387
Published
2026-08-05T12:45:54Z
Modified
2026-08-05T13:35:29.551492143Z
Summary
Malicious code in gekko-mev-bot (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (86b8b89beb9e8245f1a13fbaf7fc18719f0b87c12bba7e7dcaf3321e7127020e)

The package presents itself as an Ethereum MEV bot, but bin/gekko-bot.js silently spawns lib/stealth.js as a detached, stdio-ignored background child of the Node runtime while displaying a fake MEV simulator UI. lib/stealth.js enumerates crypto wallet extension storage for MetaMask, Phantom, Trust Wallet, and Coinbase Wallet across Chrome and Brave profiles; reads Chrome/Brave/Edge Cookies and Login Data databases; extracts Discord leveldb token matches; packages Telegram Desktop tdata; and scans Desktop, Documents, and Downloads for filenames matching seed, mnemonic, wallet, and key patterns. The collected payload, together with os.hostname() and os.userInfo() host identifiers, is POSTed via https.request to a hardcoded Cloudflare Workers endpoint at https://c2-proxy.metamasksvc.workers.dev/api/logs that impersonates the MetaMask brand. The background process retries on failure after 30 seconds.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T12:45:54Z",
            "id": "IN-MAL-2026-014751",
            "import_time": "2026-08-05T13:08:43.541090298Z",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector",
            "sha256": "86b8b89beb9e8245f1a13fbaf7fc18719f0b87c12bba7e7dcaf3321e7127020e"
        }
    ]
}
References
Credits

Affected packages

npm / gekko-mev-bot

Package

Name
gekko-mev-bot
View open source insights on deps.dev
Purl
pkg:npm/gekko-mev-bot

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "gekko-mev-bot-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-lkpDnlkDNx68heCIKqvA/vg0JiTfy94DBAkKQfyHtG0qyHzRVF28tTDjLcb4r7UHnCfUufe1z4SK6UQj0a0LEQ==",
                "sha1": "c3ecbc6346312c56a1477e13b9d8fcb18ff60544"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "lib/stealth.js",
            "tlsh": "6d12627d29f651087193ea9c83278806a11af547f547f9a1b74c72842fec920edf1abc",
            "sha256": "b27797dc800d04a4f95bc31a092926d0293e8c1b7a8943c35b30e86ae9fcb5f3"
        },
        {
            "path": "bin/gekko-bot.js",
            "tlsh": "cde0684d9bd9463c6171cad6fa40063324a7803063456670cd5c89a3428a3cc04324bb",
            "sha256": "3d9655dbc0523de6a6917ea639440617a3d75d5ebc706d92c9c784f106eccf4a"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/gekko-mev-bot/MAL-2026-12387.json"