If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (b1eff108aebd0c94cd1b2c9dd2321060f61236e0dbf655c62f729169dcd5d5b3)
The malicious code is in the ethrpc-keys package, which is a clone of legitimate eth-keys, but contains a modification that silently exfiltrates the user's private key. Other packages in the campaign are also clones of legitimate packages, but the only modification is in pulling (directly or traversally) the malicious dependency. At the end, all packages in the campaign exfiltrate the private key.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-02-old-ethrpc-keys
Reasons (based on the campaign):
- clones-real-package
- exfiltration-crypto
- crypto-related
- action-hidden-in-lib-usage
- The malicious code is intentionally included in a dependency of the package
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
Domains
- sign-tx[.]web3rpc[.]workers[.]dev other packages →
URLs
- hxxps://sign-tx[.]web3rpc[.]workers[.]dev/index[.]php?dpr= other packages →