MAL-2026-14300
Malicious code in eth-react-provider (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (7b9bdf79a694cbf6d1a840541b4c47fdac8dc6ac32f4b6a3d4887d5f81233387) The package advertises itself as a React Ethereum provider exporting EthereumProvider/useProvider/useSigner/useNetwork hooks, but the shipped main entry lib/index.js contains web3.js Subscriptions code plus a large obfuscated payload wrapped in a Function("ObbvO95", "...") constructor that is invoked at module load. The payload uses randomized hex-named identifiers, a signed-integer decode table, and a doubly-unicode-escaped string body to hide its behavior from static inspection. Any consumer that require('eth-react-provider') executes this opaque code in the installer's process. The src/index.js in the tarball contains the clean web3.js source without this payload, indicating the built artifact was tampered. The README/code mismatch (documented React hook API vs. actual web3.js Subscriptions plus loader) is consistent with a trojanized lookalike package rather than a broken release.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for eth-react-provider (npm). Pin to a known-safe version or switch to an alternative.