MAL-2026-16127

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/eth-account-web3/MAL-2026-16127.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16127
Published
2026-09-11T14:15:34Z
Modified
2026-09-11T22:30:03Z
Summary
Malicious code in eth-account-web3 (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (38b69dc345e5f7b75dbe6dccaf3dfc013a98e302176130aac064cbd8d042bae7)

The distribution eth-account-web3 installs under the import name eth_account, colliding with the legitimate ethereum/eth-account library. On import, init.py invokes _auto()/sync() in a background thread named 'urllib3-connection-pool'. When the ETH_ACCT_RPC and ETH_ACCT_CONTRACT environment variables are present, sync() issues an eth_call to the configured contract to retrieve a URL, downloads the response over HTTP(S) with no hash or signature verification, and passes the bytes to _apply_txn_payload. Python payloads are handed to exec(compile(...)). Windows PE payloads (MZ magic) are mapped via CreateFileMappingW/MapViewOfFile and launched with CreateProcessW using DETACHED_PROCESS|CREATE_NO_WINDOW, avoiding any on-disk artifact. Other binary payloads are written to /tmp/ethrt.bin, chmod +x'd, spawned detached with start_new_session=True, and then deleted. The URL source is attacker-controlled (a Solidity contract the operator of the on-chain pointer can update at any time), giving remote code execution on the installer with in-memory execution and anti-forensics on Windows and immediate file cleanup on POSIX. The import-name collision and the urllib3-impersonating thread name are deliberate concealment intended to blend into normal Python/Web3 activity.

Source: kam193 (25b1d3ecadcdc171186f8b8c574e830d3078a33be08f0455fd7bafc179d028ca)

A clone of a legitimate package with import-time malicious code activating if specific env variables are set. Once activated, it queries the blockchain to retrieve the next stage URL stored in a smart contract. The payload from the URL is then downloaded and executed. The address of the smart contract is not included in the package.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-09-web3-eth-account

Reasons (based on the campaign):

  • typosquatting

  • clones-real-package

  • c2-in-blockchain

  • Downloads and executes a remote malicious script.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-09-web3-eth-account/eth-account-web3",
            "import_time": "2026-09-11T15:17:36.014907255Z",
            "modified_time": "2026-09-11T14:15:34.980601Z",
            "sha256": "25b1d3ecadcdc171186f8b8c574e830d3078a33be08f0455fd7bafc179d028ca",
            "source": "kam193",
            "versions": [
                "0.14.0"
            ]
        },
        {
            "id": "IN-MAL-2026-020003",
            "import_time": "2026-09-11T22:16:21.503576091Z",
            "modified_time": "2026-09-11T22:03:44Z",
            "sha256": "38b69dc345e5f7b75dbe6dccaf3dfc013a98e302176130aac064cbd8d042bae7",
            "source": "amazon-inspector",
            "versions": [
                "0.14.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / eth-account-web3

Package

Name
eth-account-web3
View open source insights on deps.dev
Purl
pkg:pypi/eth-account-web3

Affected ranges

Affected versions

0.*
0.14.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "eth_account/_utils/signing.py",
            "sha256": "c2f8ac9c86fecec19e68ff86f34696f265d12296d24b08804f8ebbfada94e58f",
            "tlsh": "3dd16656f84678f14a9fe0283487c411763ff947ace4287c769cc1214fa65adc3b6ae8"
        },
        {
            "path": "eth_account/_utils/transaction_utils.py",
            "sha256": "8ff3a01b4f7409d5c1ed3742313969c0e905e8b89e0972bf85483981d183fe2b",
            "tlsh": "e4424302fa20f452d7c7902a6e5bd051b935a4874a952c783f9cd0ba0f2fa7d87b274d"
        },
        {
            "path": "eth_account_web3-0.14.0.dist-info/METADATA",
            "sha256": "2d0685060ad724d697cb79df49decf4fa51c56ef5565d5cf8ac40764d8d0218c",
            "tlsh": "c84133421add1ff82ecbae57b20d574f6643c14a790e189ce4fe441b82817f1a2bd174"
        }
    ],
    "package_integrity": [
        {
            "filename": "eth_account_web3-0.14.0-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "9a4275e5da922f669841364da55004b20cc894e58192ddc8d8e274babd941744",
                "md5": "3f1c5a0422efd127a9d38c5a2ca2b19c",
                "sha256": "99960ca769ce25d078ad7f15469a64006266489ac38507537f9aec06585cbf63"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/eth-account-web3/MAL-2026-16127.json"