Which versions of eth-dev are malicious?

The following npm versions of eth-dev are flagged malicious: 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4. Treat any of these as compromised.

How do I remediate eth-dev if I installed it?

eth-dev is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed eth-dev — how do I know if it already compromised me?

If eth-dev was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is eth-dev part of a known attack campaign?

Yes — eth-dev is associated with the IN-MAL-2026-010401, IN-MAL-2026-010400, IN-MAL-2026-010402, IN-MAL-2026-010507, IN-MAL-2026-010535 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find eth-dev across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for eth-dev (5 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging eth-dev across your stack and pipelines.

Malicious package

eth-devnpm

eth-dev is a confirmed malicious npm package (MAL-2026-10552) that steals credentials and exfiltrates sensitive data (malicious versions 1.0.0, 1.0.1, 1.0.2…). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in eth-dev (npm)

MAL-2026-10552

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall eth-dev

What this malware does

On require(), index.js schedules a 37-second delayed routine that reads test/fixtures/keypairs.dat, base64-decodes it into ~/.cache-db/.node-sync/syncd.js (mode 0o700), and spawns it detached via node syncd.js. The dropper installs OS-specific persistence to re-execute every 12 hours: a crontab entry on Linux, a scheduled task named 'WinNodeSync' on Windows, and a LaunchAgent at ~/Library/LaunchAgents/com.apple.syncd.plist on macOS. The decoded payload ('phantom syncd v3') walks the user's home directory matching filenames and contents against wallet/seed keywords (seed, mnemonic, recovery, wallet, private, metamask, phantom, ledger, trezor,...), pulls mutable configuration from a hardcoded GitHub Gist (juang55/b298754cb72942b1cdcf02ccd45cde2f), and uploads harvested material to Pinata IPFS using hardcoded API credentials embedded in the payload. Cover-story naming (keypairs.dat as a 'test fixture', com.apple.syncd, WinNodeSync) is used to mimic legitimate system services. The package presents itself as an Ethereum utilities library.

Malicious versions

5 flagged

1.0.01.0.11.0.21.0.31.0.4

Indicators of compromise (SHA-256)

51f051957ac6f91e8567df873978b45c0c81a170f94decbd735d329f312ff1bb

605cf5aa9087e75f5c626943f65433b80f003a8a5169b20ba00354e720f0d58f

ed1b1d03321430ea28173c5a446904054fa9ea4410f41b6071c13765fae51572

245d32980e6b9ac37750d52d24d81599a2fac0167c0a497ef560ead6685ebc45

6f230c5d2abfbe1f677ce624fc24064c029ee717512f750713e2b5a7a8ab9186

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for eth-dev (5 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging eth-dev across your stack and pipelines.
If you installed it — respond
eth-dev is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If eth-dev was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks eth-dev before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. eth-dev on npm has been identified as a malicious package (versions 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-010401IN-MAL-2026-010400IN-MAL-2026-010402IN-MAL-2026-010507IN-MAL-2026-010535

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks eth-dev-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database