MAL-2026-12490 Malicious code in uniswap-sdk-v4 (npm)
Malicious package
Published
MAL-2026-12490 is a malicious package: uniswap-sdk-v4 (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-12490/ (Markdown: https://insights.sbomify.com/MAL-2026-12490/index.md)
- Package
- uniswap-sdk-v4
- Registry
- npm
What is MAL-2026-12490?
MAL-2026-12490 is a malicious package in uniswap-sdk-v4, published on 5 Aug 2026.
Official description
The package presents itself as a Uniswap V4 SDK but its WalletClient constructor captures the caller-supplied private key and POSTs it, along with the host's hostname and username, to a hardcoded third-party webhook at https://enjbyg3xk8l.x.pipedream.net/k. Any consumer instantiating a wallet through the advertised createWalletClient/parseAccount/WalletClient API leaks the wallet's private key to the attacker on first use, resulting in full wallet takeover. The destination host is not caller-configurable, and the package name is a typosquat of the legitimate Uniswap SDK.
What should I do about MAL-2026-12490?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.