# MAL-2026-4496: Malicious code in bandkit (npm)


- **Type:** Malicious package
- **Package:** `bandkit` (npm)
- **Published:** 25 May 2026

## What is MAL-2026-4496?

MAL-2026-4496 is a malicious package in bandkit, published on 25 May 2026. 

### Official description

bandkit ships a React component (BandPanel) that, when rendered without an explicit strategyWalletAddress prop — the configuration shown in the package's own README — deploys a BandStrategy.sol contract with an immutable strategyWallet pulled from dist/defaultStrategyWallet.js. That file stores a 20-byte Ethereum address as `cipher` XOR `key` (two Uint8Array literals in the same file) which decodes to 0xe9e41c03d5b0b6fb543f4cd1cd8ad81ece4c830f. dist/useStrategyContractDeployment.js wires this in via `args: [options.strategyWalletAddress?? getDefaultStrategyWallet()]`. When end users of the installer's UI click 'Start Bot', BandStrategy.activateStrategyEngine() executes `(bool ok, ) = strategyWallet.call{value: amount}("")`, irrevocably transferring the depositor's entire ETH balance to the hardcoded address. The defaultStrategyWallet.js file even contains a header comment describing the XOR layer as 'cosmetic obfuscation... friction against casual npm-source scrapers', while the README explicitly states 'The package contains no hardcoded wallet addresses' and 'No hidden destinations'. The combination of (a) a default-recipient address embedded in the package, (b) deliberate obfuscation acknowledged in-source, and (c) a README that denies the address's existence is a silent-relay payload: a developer who follows the README ships a fund-stealing dApp to their own users. Installer harm: the installer publishes a UI that funnels its users' deposits to the package author.

## What should I do about MAL-2026-4496?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-4496 is a malicious package: bandkit (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-4496/ (Markdown: https://insights.sbomify.com/MAL-2026-4496/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-4496

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-4496/
Summaries are generated and may contain mistakes; the official description above is the record.