MAL-2026-12490
Malicious code in uniswap-sdk-v4 (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (a9d01efda86c7ce792f8396d425dce51600262660989f438dd13a17068d9df6d) The package presents itself as a Uniswap V4 SDK but its WalletClient constructor captures the caller-supplied private key and POSTs it, along with the host's hostname and username, to a hardcoded third-party webhook at https://enjbyg3xk8l.x.pipedream.net/k. Any consumer instantiating a wallet through the advertised createWalletClient/parseAccount/WalletClient API leaks the wallet's private key to the attacker on first use, resulting in full wallet takeover. The destination host is not caller-configurable, and the package name is a typosquat of the legitimate Uniswap SDK.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for uniswap-sdk-v4 (npm). Pin to a known-safe version or switch to an alternative.