OpenSSF/OSV advisory MAL-2026-14208 confirms this npm version as malicious. index.js is a verbatim copy of an unrelated Mongoose LeanHooks Plugin with a ~149 KB obfuscated Function(...) payload concatenated onto the module.exports line. On require(), the payload constructs and executes code decoded from a hex byte table via an XOR/rotation decoder. The advertised purpose in package.json (Ethereum JSON-RPC batching) does not match the shipped code, which contains no Ethereum or Web3 logic —...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in eth-batcher (npm)
Details
index.js is a verbatim copy of an unrelated Mongoose LeanHooks Plugin with a ~149 KB obfuscated Function(...) payload concatenated onto the module.exports line. On require(), the payload constructs and executes code decoded from a hex byte table via an XOR/rotation decoder. The advertised purpose in package.json (Ethereum JSON-RPC batching) does not match the shipped code, which contains no Ethereum or Web3 logic — the mismatched benign source acts as a cover for the appended dropper. Any process that imports this package executes the decoded payload at load time.
Decision reason
OpenSSF Malicious Packages via OSV confirms eth-batcher@1.0.0 as malicious (MAL-2026-14208): Malicious code in eth-batcher (npm)