MAL-2026-11994 Malicious code in @zzzgenesis00/web3-provider-engine (npm)
Malicious package
Published
MAL-2026-11994 is a malicious package: @zzzgenesis00/web3-provider-engine (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-11994/ (Markdown: https://insights.sbomify.com/MAL-2026-11994/index.md)
- Package
- @zzzgenesis00/web3-provider-engine
- Registry
- npm
What is MAL-2026-11994?
MAL-2026-11994 is a malicious package in @zzzgenesis00/web3-provider-engine, published on 4 Aug 2026.
Official description
Package impersonates MetaMask's web3-provider-engine (author field 'MetaMask', homepage pointing to github.com/MetaMask/web3-provider-engine) while shipping a postinstall.js that runs automatically on npm install and harvests installer secrets. postinstall.js reads ~/.ssh contents, ~/.npmrc, ~/.gitconfig, Chrome/Firefox profile databases (Cookies, Login Data, key4.db), enumerates crypto wallet directories (.bitcoin,.ethereum,.metamask,.exodus, and others), invokes npm whoami and git config, and captures roughly 30 credential-shaped environment variables including NPM_TOKEN, GITHUB_TOKEN, AWS keys, PRIVATE_KEY, MNEMONIC, SEED_PHRASE, and multiple chain-specific *_PRIVATE_KEY values. The collected data is JSON-serialized and transmitted to two hardcoded non-first-party destinations: api.telegram.org/bot<token>/sendMessage via GET with a hardcoded bot token and chat_id, and https://40f955f39128bd79-178-249-214-24.serveousercontent.com/collect via POST. index.js provides a stub web3 API surface (createWallet, generateMnemonic returning random bytes) to appear functional and disguise the harvest.
What should I do about MAL-2026-11994?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.