What does the @web3-helpers/core malware do?

At npm install time the preinstall script (dist/index.min.js) reads installer-owned secrets — ~/.ssh/id_rsa, ~/.env, ~/.env.local, ~/.wallet.json — and iterates process.env for keys matching PRIVATE_*, MNEMONIC*, and SECRET*. Extracted content is scanned for 64-hex and WIF private keys and posted, along with the installer's hostname and username, to https://api.telegram.org/bot /sendMessage using a hardcoded bot token. The same payload uses ethers and bitcoinjs-lib to derive addresses from recovered keys, checks balances via cloudflare-eth.com and blockchain.info, and broadcasts signed transactions sweeping funds to hardcoded ETH_WALLET/BTC_WALLET recipient addresses (labeled 'PAYLO

Which versions of @web3-helpers/core are malicious?

The following npm versions of @web3-helpers/core are flagged malicious: 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6. Treat any of these as compromised.

How do I remediate @web3-helpers/core if I installed it?

@web3-helpers/core is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed @web3-helpers/core — how do I know if it already compromised me?

If @web3-helpers/core was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is @web3-helpers/core part of a known attack campaign?

Yes — @web3-helpers/core is associated with the IN-MAL-2026-010550, IN-MAL-2026-010559, IN-MAL-2026-010552, IN-MAL-2026-010549, IN-MAL-2026-010556, IN-MAL-2026-010551, IN-MAL-2026-010558 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find @web3-helpers/core across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for @web3-helpers/core (7 malicious versions).

Malicious package

@web3-helpers/corenpm

Advisory published Jul 14, 2026Updated Jul 14, 2026

@web3-helpers/core is a confirmed malicious npm package (MAL-2026-10611) that steals credentials and exfiltrates sensitive data (malicious versions 1.0.0, 1.0.1, 1.0.2…). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in @web3-helpers/core (npm)

MAL-2026-10611

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall @web3-helpers/core

What this malware does

At npm install time the preinstall script (dist/index.min.js) reads installer-owned secrets — ~/.ssh/id_rsa, ~/.env, ~/.env.local, ~/.wallet.json — and iterates process.env for keys matching PRIVATE_, MNEMONIC, and SECRET*. Extracted content is scanned for 64-hex and WIF private keys and posted, along with the installer's hostname and username, to https://api.telegram.org/bot<redacted>/sendMessage using a hardcoded bot token. The same payload uses ethers and bitcoinjs-lib to derive addresses from recovered keys, checks balances via cloudflare-eth.com and blockchain.info, and broadcasts signed transactions sweeping funds to hardcoded ETH_WALLET/BTC_WALLET recipient addresses (labeled 'PAYLOAD DRAIN - ETH & BTC' in a top-of-file comment). A binding.gyp file additionally uses GYP command expansion (<!(node -e "require('./dist/index.min.js')...")) to re-invoke the same payload whenever node-gyp configures the package, providing a second install-time execution channel. The package name mimics legitimate Web3 helper libraries, package.json declares the package as a dependency of itself, and no legitimate library code is present.

Malicious versions

7 flagged

1.0.01.0.11.0.21.0.31.0.41.0.51.0.6

Indicators of compromise (SHA-256)

673acc92b18aa385701afe25bcb0d4da048befdd8143598ba554b62636933464

802fa1bdc8bbd31952bbde5adc7a537674a5d1e73f36c1030d6ebda0b364e0bc

9d5230cf08adcdf1d9108129f5c80e569b74774b7f2cb5e55aeb60be8d737225

bb43f9d9c5d297e5acc040dcc52ec91e44312af87b70777cdd438ae5107c795c

c619fef9a5f0e633c0649958f00fb9754e372df8025a0a20472911eb7364421d

e4a7081cede1c6330f3f5fef7baba3590b652557f995cf35ad724cc24e0593d3

7963f106618c7defa2e9704d7a1fd372c50bb733f7a7aaab92ffc284f5b2eb11

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for @web3-helpers/core (7 malicious versions).
If you installed it — respond
@web3-helpers/core is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If @web3-helpers/core was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. @web3-helpers/core on npm has been identified as a malicious package (versions 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-010550IN-MAL-2026-010559IN-MAL-2026-010552IN-MAL-2026-010549IN-MAL-2026-010556IN-MAL-2026-010551IN-MAL-2026-010558

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks @web3-helpers/core-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database