paidwithtab@3.0.0
OpenSSF/OSV Malicious Advisory
imported 2d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18521 confirms this npm version as malicious.
Advisory
MAL-2026-18521
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in paidwithtab (npm)
Details
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
References
Independent LPM AI assessment
CleanIndependent AI assessment: clean. LPM AI assessed this version as clean; the assessments disagree.
The package's flagged wallet transfer is a user-run funding command whose source key, destination and amount come from its arguments. The inspected Anthropic key flow validates a user-submitted key with the configured Anthropic API; no automatic theft or unauthorized spending was found.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Wallet transfers require a user to run `tab evm fund` with source and destination arguments; key validation occurs when a user submits a company model key.
Impact
No unauthorized transfer or credential disclosure was identified in the inspected flows.
Mechanism
The CLI signs and sends the requested EVM transfer. The company server sends a submitted Anthropic key to the configured Anthropic API for validation and seals it for later company use.
AI rationale
The package's flagged wallet transfer is a user-run funding command whose source key, destination and amount come from its arguments. The inspected Anthropic key flow validates a user-submitted key with the configured Anthropic API; no automatic theft or unauthorized spending was found.
Network endpoints3
paidwithtab.compay.paidwithtab.comAnthropic API at configured anthropicUrl
Independent scan evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The npm entrypoint is a CLI; the package exports the buyer-side payment client.
- The client signs and retries a payment only after receiving an HTTP 402 challenge.
- The EVM token transfer requires explicit source key, destination, token and amount arguments.
- The company server checks a submitted Anthropic key against the configured Anthropic API, then seals it for company use.
Evidence against
- The scanner flags wallet transfers, but the inspected transfer is behind the explicit `evm fund` command and uses the supplied destination and amount.
- The source references credentials and network calls; the inspected Anthropic key flow sends a user-submitted key to the model API for validation.
- The package declares a `prepublishOnly` build-and-test script, not an install lifecycle hook.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStrings
Source & flagged code
4 flaggeddist/src/cli.jsView file
3import { parseArgs } from 'node:util';
L4: import { [redacted] } from 'node:net';
L5: import { existsSync, readFileSync, writeFileSync } from 'node:fs';
...
L37: try {
L38: return JSON.parse(readFileSync(packageFile('package.json'), 'utf8')).version;
L39: }
...
L97: export const PUBLIC_CATALOG = 'https://paidwithtab.com';
L98: const TAB_HOME = process.env.TAB_HOME || join(homedir(), '.tab');
L99: function log(msg) {
...
L325: if (rest[0] === '--help' || rest[0] === '-h') {
L326: process.stdout.write(COMPANY_USAGE);
L327: return;
Critical
Wallet Drain
Source uses private key material to transfer cryptocurrency funds.
dist/src/cli.jsView on unpkg · L33Trigger-reachable chain: manifest.bin -> bin/tab.js -> dist/src/cli.js
L3: import { parseArgs } from 'node:util';
L4: import { [redacted] } from 'node:net';
L5: import { existsSync, readFileSync, writeFileSync } from 'node:fs';
...
L37: try {
L38: return JSON.parse(readFileSync(packageFile('package.json'), 'utf8')).version;
L39: }
...
L97: export const PUBLIC_CATALOG = 'https://paidwithtab.com';
L98: const TAB_HOME = process.env.TAB_HOME || join(homedir(), '.tab');
L99: function log(msg) {
...
L325: if (rest[0] === '--help' || rest[0] === '-h') {
L326: process.stdout.write(COMPANY_USAGE);
L327: return;
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/src/cli.jsView on unpkg · L3Findings
2 Critical2 High3 Medium5 Low
CriticalWallet Draindist/src/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/src/cli.js
HighSemantic Analysis Limiteddist/src/company/engine.js#virtual:normalized:round1
HighAi Review Evidencepackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to paidwithtab@3.0.0.
See all versions of paidwithtab for other recorded verdicts.
- Avoid installing paidwithtab@3.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.