{"id":"MAL-2026-16129","kind":"package","aliases":["MAL-2026-16129"],"related":[],"title":"Malicious code in web3-eth-account (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (19e3eadaccc63a1e12d0e3cfe153cbf78e114f30285d4da3694990827e5f5c5a)\nThe package `web3-eth-account` typosquats the legitimate `eth-account` library and copies its metadata (ApeWorX/ethereum.org author addresses, README instructing `pip install eth-account`). On `import eth_account`, `__init__.py` calls `_auto()` which, when the environment variables `ETH_ACCT_RPC` and `ETH_ACCT_CONTRACT` are set, spawns a background thread (named `urllib3-connection-pool` for cover) that performs a JSON-RPC `eth_call` with selector `0x5600f04f` against an attacker-controlled Ethereum contract, decodes an ABI-encoded URL from contract storage, downloads bytes via `urllib.request.urlopen`, and hands them to `_apply_txn_payload` in `signing.py` / `transaction_utils.py`. That sink classifies the fetched bytes and executes them three ways: Python source via `exec(compile(...))`; Windows PE loaded in-memory via ctypes `CreateFileMappingW`/`MapViewOfFile`/`CreateProcessW`; otherwise written to `/tmp/_ethrt_<pid>.bin`, `chmod +x`, launched via `subprocess.Popen` in a new session with the file removed after launch. The C2 URL is resolved on-chain rather than embedded as a literal, defeating static URL extraction, and the dropper functions are disguised under transaction/signing names.\n\n## Source: kam193 (bd36aeb2d45881a66bf5373c0b91a108637938dab5e0c153525e6f938c9c9503)\nA clone of a legitimate package with import-time malicious code activating if specific env variables are set. Once activated, it queries the blockchain to retrieve the next stage URL stored in a smart contract. The payload from the URL is then downloaded and executed. The address of the smart contract is not included in the package.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-09-web3-eth-account\n\n\nReasons (based on the campaign):\n\n\n - typosquatting\n\n\n - clones-real-package\n\n\n - c2-in-blockchain\n\n\n - Downloads and executes a remote malicious script.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"web3-eth-account","fixed":[],"affected":"= 0.14.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-09-11T14:12:59+00:00","first_seen_at":"2026-10-26T20:51:57+00:00","triaged_at":"2026-10-26T21:10:31+00:00","updated_at":"2026-10-26T21:10:31+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-09':284C '-16129':11A,14A '-2026':10A,13A '/tmp/_ethrt_':167C '0x5600f04f':106C '19e3':34C '2026':283C 'abi':117C 'abi-encod':116C 'account':7A,18A,41C,47C,62C,66C,288C 'acct':77C,81C 'activ':226C,234C 'address':55C,261C 'amazon':32C 'amazon-inspector':31C 'apeworx/ethereum.org':53C 'appli':131C 'attack':110C 'attacker-control':109C 'author':54C 'auto':70C 'background':87C 'base':290C 'bd36aeb2d45881a66bf5373c0b91a108637938dab5e0c153525e6f938c9c9503':213C 'bin':168C 'blockchain':238C,302C 'byte':124C,142C 'c2':185C,300C 'c2-in-blockchain':299C 'call':69C,103C 'campaign':275C,282C,293C 'categori':272C 'chain':191C 'chmod':169C 'classifi':139C 'clear':277C 'clone':215C,296C 'clones-real-packag':295C 'code':2A,225C 'compil':152C 'connect':92C 'contract':82C,113C,121C,249C,265C 'control':111C 'copi':50C 'cover':95C 'createfilemappingw':161C 'createprocessw':163C 'ctype':160C 'decod':114C 'defeat':198C 'detail':23C 'disguis':207C 'download':123C,257C,303C 'dropper':204C 'eadaccc63a1e12d0e3cfe153cbf78e114f30285d4da3694990827e5f5c5a':35C 'edit':26C 'embed':194C 'encod':118C 'env':229C 'environ':74C 'eth':6A,17A,40C,46C,61C,65C,76C,80C,102C,287C 'eth-account':45C,60C 'ethereum':112C 'exec':151C 'execut':144C,259C,305C 'extract':201C 'fetch':141C 'file':180C 'function':205C 'hand':128C 'import':64C,222C 'import-tim':221C 'in-memori':156C 'includ':268C 'infosteal':281C 'init':67C 'inspector':33C 'instal':59C 'instruct':57C 'intent':279C 'json':100C 'json-rpc':99C 'kam193':212C 'launch':171C,183C 'legitim':44C,218C 'librari':48C 'like':280C 'line':29C 'liter':197C 'load':155C 'mal':9A,12A 'malici':1A,19B,224C,273C,278C,308C 'mapviewoffil':162C 'memori':158C 'metadata':52C 'name':89C,210C 'new':176C 'next':242C 'on-chain':189C 'otherwis':164C 'packag':20B,37C,219C,271C,298C 'payload':133C,251C 'pe':154C 'per':21C 'perform':97C 'pip':58C 'pool':93C 'py':68C 'pypi':8A 'python':148C 'queri':236C 'rather':192C 'readm':56C 'real':297C 'reason':289C 'remot':307C 'remov':181C 'resolv':188C 'retriev':240C 'rpc':78C,101C 'script':309C 'selector':105C 'session':177C 'set':84C,232C 'signing.py':135C 'sink':138C 'smart':248C,264C 'sourc':22C,30C,149C,211C 'spawn':85C 'specif':228C 'stage':243C 'static':199C 'storag':122C 'store':245C 'subprocess.popen':173C 'thread':88C 'three':146C 'time':223C 'transaction/signing':209C 'transaction_utils.py':136C 'txn':132C 'typosquat':42C,294C 'url':119C,186C,200C,244C,254C 'urllib.request.urlopen':126C 'urllib3':91C 'urllib3-connection-pool':90C 'variabl':75C,230C 'via':125C,150C,159C,172C 'way':147C 'web3':5A,16A,39C,286C 'web3-eth-account':4A,15A,38C,285C 'window':153C 'written':165C 'x':170C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-11T14:12:59+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-16129","url":"https://osv.dev/vulnerability/MAL-2026-16129","severity":"critical","published_at":"2026-09-11T14:12:59+00:00","modified_at":"2026-09-11T22:30:03+00:00","first_seen_at":"2026-10-26T20:51:57+00:00","fetched_at":"2026-10-26T20:51:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}