MAL-2026-16129 Malicious code in web3-eth-account (PyPI)

The package web3-eth-account typosquats the legitimate eth-account library and copies its metadata (ApeWorX/ethereum.org author addresses, README instructing pip install eth-account). On import eth_account, __init__.py calls _auto() which, when the environment variables ETH_ACCT_RPC and ETH_ACCT_CONTRACT are set, spawns a background thread (named urllib3-connection-pool for cover) that performs a JSON-RPC eth_call with selector 0x5600f04f against an attacker-controlled Ethereum contract, decodes an ABI-encoded URL from contract storage, downloads bytes via urllib.request.urlopen, and hands them to _apply_txn_payload in signing.py / transaction_utils.py. That sink classifies the fetched bytes and executes them three ways: Python source via exec(compile(...)); Windows PE loaded in-memory via ctypes CreateFileMappingW/MapViewOfFile/CreateProcessW; otherwise written to /tmp/_ethrt_<pid>.bin, chmod +x, launched via subprocess.Popen in a new session with the file removed after launch. The C2 URL is resolved on-chain rather than embedded as a literal, defeating static URL extraction, and the dropper functions are disguised under transaction/signing names.

A clone of a legitimate package with import-time malicious code activating if specific env variables are set. Once activated, it queries the blockchain to retrieve the next stage URL stored in a smart contract. The payload from the URL is then downloaded and executed. The address of the smart contract is not included in the package.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-09-web3-eth-account

Reasons (based on the campaign):

• typosquatting

• clones-real-package

• c2-in-blockchain

• Downloads and executes a remote malicious script.