MAL-2026-14300

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/eth-react-provider/MAL-2026-14300.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14300
Aliases
  • GHSA-rr86-r66c-qc54
Published
2026-08-19T10:14:36Z
Modified
2026-10-14T22:30:05Z
Summary
Malicious code in eth-react-provider (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (7b9bdf79a694cbf6d1a840541b4c47fdac8dc6ac32f4b6a3d4887d5f81233387)

The package advertises itself as a React Ethereum provider exporting EthereumProvider/useProvider/useSigner/useNetwork hooks, but the shipped main entry lib/index.js contains web3.js Subscriptions code plus a large obfuscated payload wrapped in a Function("ObbvO95", "...") constructor that is invoked at module load. The payload uses randomized hex-named identifiers, a signed-integer decode table, and a doubly-unicode-escaped string body to hide its behavior from static inspection. Any consumer that require('eth-react-provider') executes this opaque code in the installer's process. The src/index.js in the tarball contains the clean web3.js source without this payload, indicating the built artifact was tampered. The README/code mismatch (documented React hook API vs. actual web3.js Subscriptions plus loader) is consistent with a trojanized lookalike package rather than a broken release.

Source: ghsa-malware (b162f07f49b00538ec535c8fb33f0f6561ec39893acb28e55a8450de8a026322)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-018420",
            "import_time":  "2026-08-19T10:44:44.683387848Z",
            "modified_time":  "2026-08-19T10:14:36Z",
            "sha256":  "7b9bdf79a694cbf6d1a840541b4c47fdac8dc6ac32f4b6a3d4887d5f81233387",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.0"
            ]
        },
        {
            "id":  "GHSA-rr86-r66c-qc54",
            "import_time":  "2026-10-14T22:23:09.454941486Z",
            "modified_time":  "2026-10-14T22:21:13Z",
            "ranges":  [
                {
                    "events":  [
                        {
                            "introduced":  "0"
                        }
                    ],
                    "type":  "SEMVER"
                }
            ],
            "sha256":  "b162f07f49b00538ec535c8fb33f0f6561ec39893acb28e55a8450de8a026322",
            "source":  "ghsa-malware"
        }
    ]
}
References
Credits

Affected packages

npm / eth-react-provider

Package

Name
eth-react-provider
View open source insights on deps.dev
Purl
pkg:npm/eth-react-provider

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "lib/index.js",
            "sha256":  "faaf7c7168b80ef8148c54ed779926fed0edd38bb391f980f5e12981bcbb9683",
            "tlsh":  "eeb3bac722fa961dcc92cea08df45e4d43a85422cfc510c4bf979d5ee6ae690ebe1344"
        },
        {
            "path":  "README.md",
            "sha256":  "fb64b35dde8d878f96e9278195f9fac32aa9242901a2808d99fd76c4c8ff2ccb",
            "tlsh":  "0ac18438a57923c046630cc7bec76d65db9c306a304c80f966abe270d7d3e998ead5c5"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "eth-react-provider-1.0.0.tgz",
            "hashes":  {
                "sha1":  "fe0aa0870dcfce8d5e8fb920191bc973ee558a88",
                "sha512_sri":  "sha512-EItjOF5tvXI5P6dVh/mfTOG6GKE42M0aYp3DMndl8PaOitbqeaq45cwBHdJ63TdEVoky5Zq0TB3KVIKGAZ1fCg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/eth-react-provider/MAL-2026-14300.json"