# MAL-2026-5356: Malicious code in ethereum-kit-9 (npm)


- **Type:** Malicious package
- **Package:** `ethereum-kit-9` (npm)
- **Published:** 9 Jun 2026

## What is MAL-2026-5356?

MAL-2026-5356 is a malicious package in ethereum-kit-9, published on 9 Jun 2026. 

### Official description

Crypto/SSH/wallet stealer, blockchain-helper-0 campaign sibling (c960+). postinstall auto-execs, src/index.js harvests ~/.ssh/id_rsa+id_ed25519+Sol/Eth/BTC/Tron/Sui/Aptos wallets+.env+seeds, self-labels "CRYPTO STEALER", exfils to SAME Telegram bot 8227918239 chat 6433587894 (not rotated). Campaign now uses inflated version (1.25.36) not 1.0.0.

On `npm install`, the package's postinstall hook loads src/index.js, which after a short delay and a sandbox/CI evasion check enumerates the installer's home and project directories for sensitive files and uploads each one to api.telegram.org using a hardcoded bot token and chat_id. Targeted paths include SSH private keys (~/.ssh/id_rsa, id_ed25519), crypto wallet keystores and data directories for Solana, Ethereum (~/.ethereum/keystore), Bitcoin, Tron, Sui, and Aptos, and project secrets (.env,.env.local, mnemonic.txt, seed.txt, wallet.json, private.key, secrets.json). The payload skips execution when CI/sandbox indicators are present (CI=true, GITHUB_ACTIONS, NODE_ENV=test/development, usernames like runner/sandbox/docker/jenkins, and 12-hex-char container hostnames) to evade analysis. The package name and generic 'Utility library' description with placeholder author impersonate Ethereum tooling to lure developers.

## What should I do about MAL-2026-5356?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-5356 is a malicious package: ethereum-kit-9 (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-5356/ (Markdown: https://insights.sbomify.com/MAL-2026-5356/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-5356

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-5356/
Summaries are generated and may contain mistakes; the official description above is the record.