MAL-2026-14300

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/eth-react-provider/MAL-2026-14300.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14300
Published
2026-08-19T10:14:36Z
Modified
2026-08-19T11:00:11Z
Summary
Malicious code in eth-react-provider (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (7b9bdf79a694cbf6d1a840541b4c47fdac8dc6ac32f4b6a3d4887d5f81233387)

The package advertises itself as a React Ethereum provider exporting EthereumProvider/useProvider/useSigner/useNetwork hooks, but the shipped main entry lib/index.js contains web3.js Subscriptions code plus a large obfuscated payload wrapped in a Function("ObbvO95", "...") constructor that is invoked at module load. The payload uses randomized hex-named identifiers, a signed-integer decode table, and a doubly-unicode-escaped string body to hide its behavior from static inspection. Any consumer that require('eth-react-provider') executes this opaque code in the installer's process. The src/index.js in the tarball contains the clean web3.js source without this payload, indicating the built artifact was tampered. The README/code mismatch (documented React hook API vs. actual web3.js Subscriptions plus loader) is consistent with a trojanized lookalike package rather than a broken release.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-018420",
            "import_time": "2026-08-19T10:44:44.683387848Z",
            "modified_time": "2026-08-19T10:14:36Z",
            "sha256": "7b9bdf79a694cbf6d1a840541b4c47fdac8dc6ac32f4b6a3d4887d5f81233387",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / eth-react-provider

Package

Name
eth-react-provider
View open source insights on deps.dev
Purl
pkg:npm/eth-react-provider

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "lib/index.js",
            "sha256": "faaf7c7168b80ef8148c54ed779926fed0edd38bb391f980f5e12981bcbb9683",
            "tlsh": "eeb3bac722fa961dcc92cea08df45e4d43a85422cfc510c4bf979d5ee6ae690ebe1344"
        },
        {
            "path": "README.md",
            "sha256": "fb64b35dde8d878f96e9278195f9fac32aa9242901a2808d99fd76c4c8ff2ccb",
            "tlsh": "0ac18438a57923c046630cc7bec76d65db9c306a304c80f966abe270d7d3e998ead5c5"
        }
    ],
    "package_integrity": [
        {
            "filename": "eth-react-provider-1.0.0.tgz",
            "hashes": {
                "sha1": "fe0aa0870dcfce8d5e8fb920191bc973ee558a88",
                "sha512_sri": "sha512-EItjOF5tvXI5P6dVh/mfTOG6GKE42M0aYp3DMndl8PaOitbqeaq45cwBHdJ63TdEVoky5Zq0TB3KVIKGAZ1fCg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/eth-react-provider/MAL-2026-14300.json"