registry / Malware / bandkit

bandkit

Removed — this package is no longer maintained. Use arbkit instead.

Open-source scaffolding for Ethereum range-bound trading strategies: strategy contract deployment, restricted executor, and React hooks. Strategy logic is not included.

This report shows the evidence for bandkit@1.0.9. 6 of 6 known versions are blocked or flagged. See all versions.

OpenSSF/OSV Malicious Advisory

imported 4mo ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-4496 confirms this npm version as malicious.

Advisory

MAL-2026-4496

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in bandkit (npm)

Details

bandkit ships a React/Solidity 'strategy bot' library whose deployment helper hardcodes an XOR-obfuscated Ethereum address (0xe9e41c03d5b0b6fb543f4cd1cd8ad81ece4c830f) as the default destination wallet. In dist/useStrategyContractDeployment.js, deployStrategyContract() passes `options.strategyWalletAddress?? getDefaultStrategyWallet()` to the BandStrategy constructor as the immutable `strategyWallet`. The shipped contract (contracts/BandStrategy.sol) then implements activateStrategyEngine() as `(bool ok, ) = strategyWallet.call{value: amount}("")`, transferring the user's full deposited ETH balance to that address; withdrawAll() returns zero afterward. The address is stored as a cipher+key XOR pair in dist/defaultStrategyWallet.js with an in-source comment acknowledging this provides 'friction against casual npm-source scrapers', while the README explicitly markets the package as having 'no hardcoded wallet addresses'. A developer following the documented quickstart and clicking the prominent 'Start Bot' button in <BandPanel/> irrevocably forwards all deposited ETH to the package author. The combination of (1) caller-supplied funds being silently routed to a hardcoded author-controlled address through the package's normal advertised API, (2) deliberate obfuscation of that address, and (3) documentation that contradicts the actual behavior leaves no plausible benign interpretation.

References

OpenSSF/OSV advisory PACKAGE PACKAGE PACKAGE PACKAGE

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

Source & flagged code

0 flagged · loading source

No flagged code excerpts are attached to this scan.

Findings

1 High

HighOsv Malicious Advisory

Affected versions and remediation

This report applies to bandkit@1.0.9.

The same advisory and Firewall decision cover 4 recorded versions

1.0.10, 1.0.11, 1.0.7, 1.0.9

The versions list below shows the verdict for each recorded version.

Avoid installing bandkit@1.0.9. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-05-26 15:16:44.613Z (UTC).

Source advisory published: 2026-05-25 23:10:12.000Z (UTC).

This report uses published external intelligence. The advisory does not provide a separate source-code analysis for each listed version.

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

6 known versions

1.0.9latestshownMaliciousMalwareBlockPublishedUnknown 1.0.7MaliciousMalwareBlockPublishedUnknown 1.0.16MaliciousMalwareBlockPublishedUnknown 1.0.14MaliciousMalwareBlockPublishedUnknown

OpenSSF/OSV Malicious Advisory

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Source & flagged code

Related packages

Other malware packages