MAL-2026-6347

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/wagmi_util/MAL-2026-6347.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6347
Published
2026-06-23T20:52:51Z
Modified
2026-06-23T21:46:27.766317239Z
Summary
Malicious code in wagmi_util (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e44ca5f8da70044150618d34a591d8a6d72aa77a5e22eb30da3e86f4b74c76ef)

Package wagmi_util impersonates the popular wagmi package: it copies wagmi's tagline ("React Hooks for Ethereum"), re-exports wagmi's full React-hooks public API (WagmiProvider, useConnect, useWalletClient, useSignMessage, useSendTransaction, useWriteContract, etc.), and links to wagmi.sh in JSDoc — while being published by an unrelated author with no legitimate wagmi_util package existing under the wevm namespace. The package.json declares a runtime dependency on sync-external@1.6.2, but no source file in the package imports sync-external; every internal use of useSyncExternalStoreWithSelector imports the legitimate use-sync-external-store/shim/with-selector.js instead. Installing wagmi_util therefore silently pulls sync-external@1.6.2 into the installer's dependency tree even though the wrapper's own code never loads it. The wrapper itself is clean re-exports of wagmi; the attack surface is the unused-but-pinned transitive, which a developer choosing a wagmi-adjacent utility would not expect to receive.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-06-23T21:37:20.776273531Z",
            "source": "amazon-inspector",
            "sha256": "e44ca5f8da70044150618d34a591d8a6d72aa77a5e22eb30da3e86f4b74c76ef",
            "versions": [
                "3.6.19"
            ],
            "id": "IN-MAL-2026-007367",
            "modified_time": "2026-06-23T20:52:51Z"
        }
    ]
}
References
Credits

Affected packages

npm / wagmi_util

Package

Name
wagmi_util
View open source insights on deps.dev
Purl
pkg:npm/wagmi_util

Affected ranges

Affected versions

3.*
3.6.19

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "0b51b91ac0a84ee216da35b4d5269556936008879aa83f2833cd513c8f1c2df41ffbdf",
            "sha256": "405fda60ae3241d15cad812639d0b7cb586204d87460749ca873b9b0485fdf11",
            "path": "package.json"
        }
    ],
    "package_integrity": [
        {
            "filename": "wagmi_util-3.6.19.tgz",
            "hashes": {
                "sha1": "002e8ce242e7163fd525acd58fe97e48183cf12b",
                "sha512_sri": "sha512-DPrDvCamvK7TK1VL2ZGkTUVaotpLslbnlAG5Nu3bDEe8jq1qOnKmjpRfI6aq9oWEUgsmoJiGwJIusUbGnQN3GQ=="
            }
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/wagmi_util/MAL-2026-6347.json"