Malicious Code Exfiltration in ethrpc Package
Summary
MAL-2026-947: Malicious code in ethrpc (PyPI). Affects ethrpc versions 6.6.2 – 6.6.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
ethrpc is a Python package available on PyPI that facilitates interactions with Ethereum-based applications. It is designed to streamline the process of sending transactions and interacting with smart contracts. However, recent findings have revealed that certain versions of ethrpc have been compromised, leading to serious security concerns regarding the exfiltration of sensitive user data, particularly private keys.
Vulnerability Detail
The vulnerability originates from a malicious code embedded in the ethrpc-keys package, which is a clone of the legitimate eth-keys package. This malicious version is designed to silently exfiltrate users' private keys without their knowledge. The campaign involves multiple packages that are clones of legitimate ones, all of which pull in this malicious dependency. The ramifications of this vulnerability are severe, as it can lead to unauthorized access to users' cryptocurrency wallets and assets, potentially resulting in significant financial loss.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall ethrpcIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users should avoid using the affected versions of the ethrpc package and consider using alternative libraries for Ethereum interactions until a secure version is confirmed. Additionally, users should monitor their private keys and wallets for any unauthorized transactions.
Conclusion
The ethrpc package has been compromised, leading to a serious vulnerability that allows for the exfiltration of private keys. Users are urged to update to a secure version and remain vigilant about their cryptocurrency security. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for ethrpc →
FAQ
ethrpc is a Python package that allows developers to interact with Ethereum blockchain applications, facilitating transaction sending and smart contract interactions.
The malicious code in the compromised ethrpc-keys package exfiltrates users' private keys by sending them to a remote server without the user's consent.
If you have used the affected versions, immediately update the package to a secure version and monitor your cryptocurrency wallets for any suspicious activity.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Using compromised packages can lead to unauthorized access to sensitive information, financial loss, and damage to your application's integrity and reputation.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
