MAL-2026-14263

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/arb-kit/MAL-2026-14263.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14263
Published
2026-08-19T06:01:04Z
Modified
2026-08-19T06:30:11.348407178Z
Summary
Malicious code in arb-kit (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ef3587f45144a9473e246cbffd1c4d03c2f895aa5052801282c4e1dd3e76be30)

arb-kit advertises itself as an Arbitrum ABI/gas toolkit, but the main entry (index.js) contains an IIFE that, 37 seconds after require, reads a base64 blob from test/fixtures/keypairs.dat, decodes it, and writes the decoded JavaScript to ~/.cache-db/.node-sync/syncd.js. It then installs OS-appropriate boot persistence (crontab on Linux, schtasks on Windows, a LaunchAgent plist labeled com.apple.syncd on macOS) and spawns node on the dropped script detached. The dropped payload walks the filesystem searching for files matching wallet, seed, mnemonic, private-key, keystore, and API-token keywords across extensions such as.env,.key,.keystore,.pem,.json, and.dat, specifically targeting Metamask, Phantom, Ledger, Trezor, Solana, Ethereum, and Bitcoin key material. Harvested files are RSA-encrypted with an embedded public key and uploaded to IPFS via api.pinata.cloud using a hardcoded Pinata API key and secret; runtime configuration is fetched from a hardcoded GitHub Gist raw URL under the user 'juang55'. The disguised staging path (.cache-db/.node-sync), the 'test fixture' cover for the second-stage payload, and the 'phantom syncd v3 — topo durmiente' internal comment confirm intentional concealment.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T06:16:07.390209266Z",
            "sha256": "ef3587f45144a9473e246cbffd1c4d03c2f895aa5052801282c4e1dd3e76be30",
            "modified_time": "2026-08-19T06:01:04Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018377",
            "versions": [
                "1.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / arb-kit

Package

Name
arb-kit
View open source insights on deps.dev
Purl
pkg:npm/arb-kit

Affected ranges

Affected versions

1.*
1.0.1

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/arb-kit/MAL-2026-14263.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "e49d10ae4543c25c36705eee15b21cf16c9271a1cd515e7379951d7d2cea9acb",
            "path": "index.js",
            "tlsh": "be91c5d969d232944a27f5fea33f441a72a560c3624cda0ebdcd82d80f484385676ff8"
        },
        {
            "sha256": "89893e61ef57050cb1129bcfc4c9d233d19ce9e6d1da06036ec9256c752a4863",
            "tlsh": "53920a22cd8f2d44df75f5872ace2ec7096c5bcaa4b25cce954b97cd844a16208fd0e9",
            "path": "test/fixtures/keypairs.dat"
        }
    ],
    "package_integrity": [
        {
            "filename": "arb-kit-1.0.1.tgz",
            "hashes": {
                "sha1": "993216e7fee35f453a90f875362c8b4f25166c69",
                "sha512_sri": "sha512-wwGl1koUivDS7S1N5Zf7ux1MsOdCvby880smM1t5vmEY8p67Ktr64yDztgU9JEIBo8cuYlUnaYRh66kYq0chFA=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]