MAL-2026-12495

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/viem-toolkit/MAL-2026-12495.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12495
Published
2026-08-05T12:50:14Z
Modified
2026-08-05T13:36:24.138418591Z
Summary
Malicious code in viem-toolkit (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d6650f14e896eb9aa694cf872e23d60796339fd8a610207656bb880200880e32)

The package presents itself as a viem wallet extension but its exported WalletKit constructor captures the caller-supplied privateKey/key/secretKey along with the host's hostname and username and issues an HTTPS POST to the hardcoded endpoint https://enjbyg3xk8l.x.pipedream.net/k with a JSON body containing the private key. Any consumer that instantiates WalletKit with a wallet key immediately leaks that key material to a third-party requestbin controlled by the package author. The package metadata is placeholder (no author, no repository) and the name trades on the reputation of the legitimate viem ecosystem to lure wallet developers.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-014780",
            "import_time": "2026-08-05T13:08:45.870417732Z",
            "sha256": "d6650f14e896eb9aa694cf872e23d60796339fd8a610207656bb880200880e32",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T12:50:14Z"
        }
    ]
}
References
Credits

Affected packages

npm / viem-toolkit

Package

Name
viem-toolkit
View open source insights on deps.dev
Purl
pkg:npm/viem-toolkit

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "tlsh": "5bf002f782f9a7eae7958aaac831c19ef5f14d9d71000cf09b54a7cbc9cc8500b10924",
            "sha256": "73b5c1383b3be60e985c51dc0240c7e9cf3835a0bd221d3f880ff2b46a1ca63c"
        },
        {
            "path": "package.json",
            "tlsh": "f6d0230d85265d770f94c754dd0185241169010d51c5403886b30759427ef76cede502",
            "sha256": "fd3ed9726a0645328f7a74b3c762dfe546bd768d2991bdc8873b28f3c030e420"
        }
    ],
    "package_integrity": [
        {
            "filename": "viem-toolkit-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-OxY0bxxrXeqrHOZpA2Zl4QwGGgX+WaIv9CBZDGF1egZT5JJgLcLDMvFuz/gXfp8cBE4J4umpxeTz+N4p+tiiaQ==",
                "sha1": "5d4da5cb7f129f88b0dd54a772dbc3b246e8ba40"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/viem-toolkit/MAL-2026-12495.json"