{"id":"MAL-2026-16127","kind":"package","aliases":["MAL-2026-16127"],"related":[],"title":"Malicious code in eth-account-web3 (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (38b69dc345e5f7b75dbe6dccaf3dfc013a98e302176130aac064cbd8d042bae7)\nThe distribution eth-account-web3 installs under the import name eth_account, colliding with the legitimate ethereum/eth-account library. On import, __init__.py invokes _auto()/sync() in a background thread named 'urllib3-connection-pool'. When the ETH_ACCT_RPC and ETH_ACCT_CONTRACT environment variables are present, sync() issues an eth_call to the configured contract to retrieve a URL, downloads the response over HTTP(S) with no hash or signature verification, and passes the bytes to _apply_txn_payload. Python payloads are handed to exec(compile(...)). Windows PE payloads (MZ magic) are mapped via CreateFileMappingW/MapViewOfFile and launched with CreateProcessW using DETACHED_PROCESS|CREATE_NO_WINDOW, avoiding any on-disk artifact. Other binary payloads are written to /tmp/_ethrt_<pid>.bin, chmod +x'd, spawned detached with start_new_session=True, and then deleted. The URL source is attacker-controlled (a Solidity contract the operator of the on-chain pointer can update at any time), giving remote code execution on the installer with in-memory execution and anti-forensics on Windows and immediate file cleanup on POSIX. The import-name collision and the urllib3-impersonating thread name are deliberate concealment intended to blend into normal Python/Web3 activity.\n\n## Source: kam193 (25b1d3ecadcdc171186f8b8c574e830d3078a33be08f0455fd7bafc179d028ca)\nA clone of a legitimate package with import-time malicious code activating if specific env variables are set. Once activated, it queries the blockchain to retrieve the next stage URL stored in a smart contract. The payload from the URL is then downloaded and executed. The address of the smart contract is not included in the package.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-09-web3-eth-account\n\n\nReasons (based on the campaign):\n\n\n - typosquatting\n\n\n - clones-real-package\n\n\n - c2-in-blockchain\n\n\n - Downloads and executes a remote malicious script.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"eth-account-web3","fixed":[],"affected":"= 0.14.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-09-11T14:15:34+00:00","first_seen_at":"2026-10-26T20:51:57+00:00","triaged_at":"2026-10-26T21:10:31+00:00","updated_at":"2026-10-26T21:10:31+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-09':311C '-16127':11A,14A '-2026':10A,13A '/sync':60C '/tmp/_ethrt_':154C '2026':310C '25b1d3ecadcdc171186f8b8c574e830d3078a33be08f0455fd7bafc179d028ca':240C '38b69dc345e5f7b75dbe6dccaf3dfc013a98e302176130aac064cbd8d042bae7':34C 'account':6A,17A,39C,47C,315C 'acct':73C,77C 'activ':237C,253C,261C 'address':288C 'amazon':32C 'amazon-inspector':31C 'anti':206C 'anti-forens':205C 'appli':113C 'artifact':147C 'attack':174C 'attacker-control':173C 'auto':59C 'avoid':142C 'background':63C 'base':317C 'bin':155C 'binari':149C 'blend':233C 'blockchain':265C,329C 'byte':111C 'c2':327C 'c2-in-blockchain':326C 'call':87C 'campaign':302C,309C,320C 'categori':299C 'chain':185C 'chmod':156C 'cleanup':213C 'clear':304C 'clone':242C,323C 'clones-real-packag':322C 'code':2A,194C,252C 'collid':48C 'collis':220C 'compil':122C 'conceal':230C 'configur':90C 'connect':68C 'contract':78C,91C,178C,276C,292C 'control':175C 'creat':139C 'createfilemappingw/mapviewoffile':131C 'createprocessw':135C 'd':158C 'delet':168C 'deliber':229C 'detach':137C,160C 'detail':23C 'disk':146C 'distribut':36C 'download':96C,284C,330C 'edit':26C 'env':256C 'environ':79C 'eth':5A,16A,38C,46C,72C,76C,86C,314C 'eth-account-web3':4A,15A,37C 'ethereum/eth-account':52C 'exec':121C 'execut':195C,203C,286C,332C 'file':212C 'forens':207C 'give':192C 'hand':119C 'hash':104C 'http':100C 'immedi':211C 'imperson':225C 'import':44C,55C,218C,249C 'import-nam':217C 'import-tim':248C 'in-memori':200C 'includ':295C 'infosteal':308C 'init':56C 'inspector':33C 'instal':41C,198C 'intend':231C 'intent':306C 'invok':58C 'issu':84C 'kam193':239C 'launch':133C 'legitim':51C,245C 'librari':53C 'like':307C 'line':29C 'magic':127C 'mal':9A,12A 'malici':1A,19B,251C,300C,305C,335C 'map':129C 'memori':202C 'mz':126C 'name':45C,65C,219C,227C 'new':163C 'next':269C 'normal':235C 'on-chain':183C 'on-disk':144C 'oper':180C 'packag':20B,246C,298C,325C 'pass':109C 'payload':115C,117C,125C,150C,278C 'pe':124C 'per':21C 'pointer':186C 'pool':69C 'posix':215C 'present':82C 'process':138C 'py':57C 'pypi':8A 'python':116C 'python/web3':236C 'queri':263C 'real':324C 'reason':316C 'remot':193C,334C 'respons':98C 'retriev':93C,267C 'rpc':74C 'script':336C 'session':164C 'set':259C 'signatur':106C 'smart':275C,291C 'solid':177C 'sourc':22C,30C,171C,238C 'spawn':159C 'specif':255C 'stage':270C 'start':162C 'store':272C 'sync':83C 'thread':64C,226C 'time':191C,250C 'true':165C 'txn':114C 'typosquat':321C 'updat':188C 'url':95C,170C,271C,281C 'urllib3':67C,224C 'urllib3-connection-pool':66C 'urllib3-impersonating':223C 'use':136C 'variabl':80C,257C 'verif':107C 'via':130C 'web3':7A,18A,40C,313C 'web3-eth-account':312C 'window':123C,141C,209C 'written':152C 'x':157C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-11T14:15:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-16127","url":"https://osv.dev/vulnerability/MAL-2026-16127","severity":"critical","published_at":"2026-09-11T14:15:34+00:00","modified_at":"2026-09-11T22:30:03+00:00","first_seen_at":"2026-10-26T20:51:57+00:00","fetched_at":"2026-10-26T20:51:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}