Malicious Code Detected in ethereum-lint Package: Version 2.0.2 Vulnerability
Summary
MAL-2026-942: Malicious code in ethereum-lint (npm). Affects ethereum-lint versions 2.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ethereum-lint package is a tool designed for linting Ethereum smart contracts, helping developers ensure code quality and adherence to best practices. It is widely used in the Ethereum development community for its ability to catch common errors and enforce coding standards. However, version 2.0.2 of this package has been identified as malicious, executing commands that can compromise user systems.
Vulnerability Detail
The vulnerability in the ethereum-lint package arises from its malicious behavior, where it executes one or more commands that can lead to unauthorized access or control over the user's system. This issue was identified by the OpenSSF Package Analysis project, which flagged the package as malicious due to its potential to harm users. The ramifications of this vulnerability include data theft, system compromise, and the execution of unwanted commands, posing a significant risk to developers and their projects.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall ethereum-lintIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the ethereum-lint package altogether until a safe version is confirmed. Alternatively, if you must use it, consider using a different linting tool for Ethereum smart contracts that has not been flagged for malicious behavior.
Conclusion
The ethereum-lint package version 2.0.2 has been identified as malicious, posing significant risks to users. It is crucial to take immediate action by uninstalling the affected version and installing a safe alternative. Monitoring tools like Vulert can help keep your projects secure from future vulnerabilities.
See every vulnerability recorded for ethereum-lint →
FAQ
ethereum-lint is a tool used for linting Ethereum smart contracts, ensuring code quality and adherence to best practices.
The malicious behavior was identified by the OpenSSF Package Analysis project, which monitors open-source packages for security issues.
If you have installed version 2.0.2, you should uninstall it immediately and install a previous or patched version of the package.
Yes, there are several alternative linting tools available for Ethereum smart contracts, such as Solhint and Solhint-Plus.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just your package-lock.json file. You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner without any signup.
