Malicious Code Exposed in ethrpc-accounts Package - Exfiltration of Private Keys
Summary
MAL-2026-948: Malicious code in ethrpc-accounts (PyPI). Affects ethrpc-accounts versions 0.9.1 – 0.9.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
ethrpc-accounts is a Python package available on PyPI that is intended to provide functionalities related to Ethereum account management. However, a malicious clone of this package has been identified, which includes harmful code that compromises user security by exfiltrating private keys through a hidden dependency, ethrpc-keys.
Vulnerability Detail
The vulnerability stems from a malicious version of the ethrpc-accounts package, specifically versions 0.9.1 and 0.9.2, which contain a hidden dependency that exfiltrates private keys to an external server. This malicious code is intentionally included to steal sensitive information from users, posing significant security risks to individuals and organizations that utilize this package for Ethereum-related operations.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall ethrpc-accountsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid using the ethrpc-accounts package until a secure version is confirmed. Additionally, consider using alternative packages for Ethereum account management that have been verified as safe.
Conclusion
The ethrpc-accounts package has been compromised, leading to a significant vulnerability that exposes users to the risk of private key theft. It is crucial for users to take immediate action by removing the affected versions and monitoring their applications for any signs of compromise.
See every vulnerability recorded for ethrpc-accounts →
FAQ
ethrpc-accounts is a Python package designed for managing Ethereum accounts, providing functionalities such as account creation and transaction signing.
The malicious code is embedded in a dependency called ethrpc-keys, which secretly sends private keys to an external server, compromising user security.
If you have installed versions 0.9.1 or 0.9.2 of ethrpc-accounts, immediately uninstall them and replace them with a secure version.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
Using the compromised package can lead to the theft of sensitive information, including private keys, which can result in unauthorized access to your Ethereum accounts and potential financial loss.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
