MAL-2026-949

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/ethrpc-keys/MAL-2026-949.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-949
Published
2026-02-19T23:39:31Z
Modified
2026-02-20T00:49:43.934748Z
Summary
Malicious code in ethrpc-keys (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (f086c363123d21b52dc28b5a642db6c1eb84e01dc519995435476b19655d63a9)

The malicious code is in the ethrpc-keys package, which is a clone of legitimate eth-keys, but contains a modification that silently exfiltrates the user's private key. Other packages in the campaign are also clones of legitimate packages, but the only modification is in pulling (directly or traversally) the malicious dependency. At the end, all packages in the campaign exfiltrate the private key.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-02-old-ethrpc-keys

Reasons (based on the campaign):

  • clones-real-package

  • exfiltration-crypto

  • crypto-related

  • action-hidden-in-lib-usage

  • The malicious code is intentionally included in a dependency of the package

Database specific 
{
    "iocs": {
        "urls": [
            "https://sign-tx.web3rpc.workers.dev/index.php?dpr="
        ],
        "domains": [
            "sign-tx.web3rpc.workers.dev"
        ]
    },
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-02-old-ethrpc-keys/ethrpc-keys",
            "import_time": "2026-02-20T00:33:04.492873484Z",
            "sha256": "f086c363123d21b52dc28b5a642db6c1eb84e01dc519995435476b19655d63a9",
            "source": "kam193",
            "modified_time": "2026-02-20T00:22:44.226541Z",
            "versions": [
                "0.4.1",
                "0.4.3",
                "0.4.5",
                "0.4.6",
                "0.4.7",
                "0.4.8",
                "0.4.9",
                "0.5.0",
                "0.5.1",
                "0.5.2",
                "0.5.3",
                "0.5.4",
                "0.5.5",
                "0.5.6",
                "0.5.7"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / ethrpc-keys

Package

Name
ethrpc-keys
View open source insights on deps.dev
Purl
pkg:pypi/ethrpc-keys

Affected ranges

Affected versions

0.*
0.4.1
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.1
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/ethrpc-keys/MAL-2026-949.json"