Malicious Code Exfiltration in ethrpc-keys Package
Summary
MAL-2026-949: Malicious code in ethrpc-keys (PyPI). Affects ethrpc-keys versions 0.4.1 – 0.5.7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ethrpc-keys is a Python package available on PyPI that is intended to provide functionality similar to the legitimate eth-keys package. However, this package has been identified as a malicious clone that contains code designed to silently exfiltrate users' private keys. This vulnerability poses a significant risk to users who may unknowingly install the compromised package, as it can lead to unauthorized access to sensitive information.
Vulnerability Detail
The vulnerability originates from a malicious modification in the ethrpc-keys package, which is a clone of the legitimate eth-keys package. The malicious code is designed to exfiltrate the user's private key without their knowledge. This type of vulnerability falls under the category of infostealers, where the intent is to capture sensitive information for malicious purposes. The campaign associated with this vulnerability includes multiple packages that similarly clone legitimate packages, all of which contain hidden actions that lead to the exfiltration of private keys.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall ethrpc-keysIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the ethrpc-keys package and instead utilize the legitimate eth-keys package. Additionally, users should monitor their systems for any unauthorized access or unusual activity that may indicate their private keys have been compromised.
Conclusion
The ethrpc-keys package has been identified as a malicious clone of the legitimate eth-keys package, designed to exfiltrate private keys from users. It is crucial for users to uninstall this package and switch to the legitimate alternative to protect their sensitive information. Regular monitoring and awareness of package integrity are essential to avoid such vulnerabilities.
See every vulnerability recorded for ethrpc-keys →
FAQ
ethrpc-keys is a Python package that was intended to provide similar functionality to the legitimate eth-keys package but has been found to contain malicious code.
The malicious code in ethrpc-keys is designed to silently exfiltrate the user's private key to a remote server without their knowledge.
If you have installed ethrpc-keys, you should uninstall it immediately and install the legitimate eth-keys package instead.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Using compromised packages can lead to unauthorized access to sensitive information, such as private keys, which can result in financial loss and security breaches.
