MAL-2026-5361 Malicious code in web3-tools-9 (npm)
- Package
- web3-tools-9
- Registry
- npm
What is MAL-2026-5361?
MAL-2026-5361 is a malicious package in web3-tools-9, published on 9 Jun 2026.
Official description
Note: This report is updated by a verification record
Crypto/SSH/wallet stealer, confirmed sibling of blockchain-helper-0 (c960). postinstall scripts/postinstall.js auto-execs, src/index.js harvests ~/.ssh/id_rsa + wallet keys/seeds + env, self-labels "CRYPTO STEALER", exfils to IDENTICAL hardcoded Telegram bot 8227918239:AAGEMDrBZluDsBBYPxfSyMuv2l3FY8cZCcs chat 6433587894 (unchanged vs c960). Campaign: generic-web3-name + numeric suffix + 1.0.0.
The package was found to contain malicious code or consuming dependency that contains malicious code
The OpenSSF Package Analysis project identified 'web3-tools-9' @ 1.0.0 (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
What should I do about MAL-2026-5361?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.