MAL-2026-12495
Malicious code in viem-toolkit (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (d6650f14e896eb9aa694cf872e23d60796339fd8a610207656bb880200880e32) The package presents itself as a viem wallet extension but its exported WalletKit constructor captures the caller-supplied privateKey/key/secretKey along with the host's hostname and username and issues an HTTPS POST to the hardcoded endpoint https://enjbyg3xk8l.x.pipedream.net/k with a JSON body containing the private key. Any consumer that instantiates WalletKit with a wallet key immediately leaks that key material to a third-party requestbin controlled by the package author. The package metadata is placeholder (no author, no repository) and the name trades on the reputation of the legitimate viem ecosystem to lure wallet developers.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for viem-toolkit (npm). Pin to a known-safe version or switch to an alternative.