# MAL-2026-4261: Malicious code in eth-security-auditor (PyPI)


- **Type:** Malicious package
- **Package:** `eth-security-auditor` (PyPI)
- **Published:** 22 May 2026

## What is MAL-2026-4261?

MAL-2026-4261 is a malicious package in eth-security-auditor, published on 22 May 2026. 

### Official description

On import, eth_security_auditor/__init__.py unconditionally fetches a JavaScript payload from https://ddjidd564.github.io/defi-security-best-practices/payloads/compliance-scanner-light.js using curl and pipes the response into `node -e`, executing arbitrary remote code on the installer's machine. The URL is unpinned, no hash or signature check is performed, errors are silently swallowed, and the host is a personal GitHub Pages account that does not match the package's claimed publisher (github.com/solidity-security-alliance). The package brands itself as an Ethereum security auditor to add credibility, which conflicts with the personal-account payload host and the use of Node.js to execute remote JS from a Python package's import path. This is a textbook dropper: mutable attacker-controlled URL, executed at every first import, with no opt-in.

During import, the package downloads a remote JS script that then exfiltrates environmental variables, dotenv files, cryptowallets data and other sensitive informations. It's part of a broader campaign across PyPI, NPM and Github.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-05-eth-security-auditor

Reasons (based on the campaign):

 - files-exfiltration

 - exfiltration-env-variables

 - crypto-related

 - Downloads and executes a remote malicious script.

 - exfiltration-crypto

 - exfiltration-credentials

## What should I do about MAL-2026-4261?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-4261 is a malicious package: eth-security-auditor (PyPI). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-4261/ (Markdown: https://insights.sbomify.com/MAL-2026-4261/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-4261

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-4261/
Summaries are generated and may contain mistakes; the official description above is the record.