MALICIOUS (1) campaign cataloged at 2026-02-19(2).
- The campaign has clearly malicious intent, like infostealers.
- This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.
2026-02-old-ethrpc-keys¶
The malicious code is in the ethrpc-keys package, which is a clone of legitimate eth-keys, but contains a modification that silently exfiltrates the user's private key. Other packages in the campaign are also clones of legitimate packages, but the only modification is in pulling (directly or traversally) the malicious dependency. At the end, all packages in the campaign exfiltrate the private key.
Abuse categories¶
action-hidden-in-lib-usage
The malicious action is hidden in the code and starts when user interacts with it (e.g. during class initialization or by exfiltrating given credentials).
clones_real_package
The package is a clone of a legitimate package or library, but with malicious code added.
crypto-related
Malicious activity is related to cryptocurrencies or blockchain, e.g. stealing crypto wallets.
exfiltration_crypto
The package attempts to steal sensitive cryptocurrency-related data, like wallet keys.
through_dependency
The malicious code is intentionally included in a dependency of the package
IoCs & related URLs¶
URLs with payloads, characteristic domains, C&C IPs, repositories with malicious code, etc.
-
hxxps://sign-tx.web3rpc.workers.dev/index.php?dpr= -
sign-tx.web3rpc.workers.dev