{"id":"MAL-2026-16127","title":"Malicious code in eth-account-web3 (PyPI)","summary":"Malicious code in eth-account-web3 (PyPI)","severity":"critical","exploited":true,"vendor":"eth-account-web3","product":"eth-account-web3","ecosystem":"pip","affected":["eth-account-web3"],"published":"2026-09-11","updated":"2026-09-11","sourceUpdated":"2026-09-11T22:30:03.722114222Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/MAL-2026-16127","references":[{"url":"https://bad-packages.kam193.eu/pypi/package/eth-account-web3"},{"url":"https://pypi.org/project/eth-account-web3/0.14.0/"}],"tags":["osv","pip","malware"],"ingestedAt":"2026-09-12T03:13:01.741Z","slug":"MAL-2026-16127","body":"## Overview\n\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (38b69dc345e5f7b75dbe6dccaf3dfc013a98e302176130aac064cbd8d042bae7)\nThe distribution eth-account-web3 installs under the import name eth_account, colliding with the legitimate ethereum/eth-account library. On import, __init__.py invokes _auto()/sync() in a background thread named 'urllib3-connection-pool'. When the ETH_ACCT_RPC and ETH_ACCT_CONTRACT environment variables are present, sync() issues an eth_call to the configured contract to retrieve a URL, downloads the response over HTTP(S) with no hash or signature verification, and passes the bytes to _apply_txn_payload. Python payloads are handed to exec(compile(...)). Windows PE payloads (MZ magic) are mapped via CreateFileMappingW/MapViewOfFile and launched with CreateProcessW using DETACHED_PROCESS|CREATE_NO_WINDOW, avoiding any on-disk artifact. Other binary payloads are written to /tmp/_ethrt_<pid>.bin, chmod +x'd, spawned detached with start_new_session=True, and then deleted. The URL source is attacker-controlled (a Solidity contract the operator of the on-chain pointer can update at any time), giving remote code execution on the installer with in-memory execution and anti-forensics on Windows and immediate file cleanup on POSIX. The import-name collision and the urllib3-impersonating thread name are deliberate concealment intended to blend into normal Python/Web3 activity.\n\n## Source: kam193 (25b1d3ecadcdc171186f8b8c574e830d3078a33be08f0455fd7bafc179d028ca)\nA clone of a legitimate package with import-time malicious code activating if specific env variables are set. Once activated, it queries the blockchain to retrieve the next stage URL stored in a smart contract. The payload from the URL is then downloaded and executed. The address of the smart contract is not included in the package.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-09-web3-eth-account\n\n\nReasons (based on the campaign):\n\n\n - typosquatting\n\n\n - clones-real-package\n\n\n - c2-in-blockchain\n\n\n - Downloads and executes a remote malicious script.\n\n\n## Affected packages\n\n- `eth-account-web3`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"abyssal","depthScore":70,"depthScoreParts":{"impact":52.3,"likelihood":0,"exploitation":18,"ransomware":0},"changes":[]}