registry / Malware / secp256k1-lib

secp256k1-lib

logger tool for validation entry

This report shows the evidence for secp256k1-lib@1.0.3. 4 of 4 known versions are blocked or flagged. See all versions.

OpenSSF/OSV Malicious Advisory

imported 2mo ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-14255 confirms this npm version as malicious.

Advisory

MAL-2026-14255

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in secp256k1-lib (npm)

Details

Package name mimics the widely used `secp256k1` cryptography library but contains no cryptographic functionality. The declared `main` (`index.js`) is a single 33KB obfuscator.io-packed bundle whose only readable tokens are `require(` and `axios`; all strings — including target hostnames, URLs, and function names — are hex-escaped entries in the `_0x4058` string array that are reconstructed at runtime. README is 24 bytes and the package description (`logger tool for validation entry`) does not match a secp256k1 implementation. On `require('secp256k1-lib')` the obfuscated bundle executes and instantiates an HTTP client (axios) targeting a runtime-constructed destination that could not be recovered from the shipped bytes. Shape matches a credential/wallet-stealer loader: name confusion with a high-value crypto package + no legitimate functionality + obfuscated import-time network capability with a hidden destination.

References

OpenSSF/OSV advisory PACKAGE PACKAGE PACKAGE PACKAGE

Independent LPM AI assessment

Suspicious

Independent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.

The concealed outbound request and unrelated package documentation create unresolved security risk, but the source does not establish automatic theft or another concrete malicious chain.

Static reason

One or more suspicious static signals were detected.

Trigger

Consumer explicitly invokes the exported connect() function.

Impact

Caller input may be disclosed to an undisclosed endpoint.

Mechanism

Obfuscated outbound HTTP GET via axios.

AI rationale

The concealed outbound request and unrelated package documentation create unresolved security risk, but the source does not establish automatic theft or another concrete malicious chain.

Evidence

package.jsonREADME.mdindex.js

Independent scan evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Unknown with low false-positive risk.

Evidence for AI warning decision

index.js is deliberately obfuscated.
index.js imports axios and builds a hidden API_BASE_URL.
Exported connect() performs an axios GET to that URL plus caller input.
README.md references a different package: evm_account.

Evidence against

package.json has no lifecycle hooks.
Network call is only in exported connect(), not import-time.
No source evidence of env/file harvesting, shell execution, or persistence.

Behavioral surface

Source

DynamicRequire

Supply chain

MinifiedObfuscatedTrivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 32.4 KB of source

Source & flagged code

2 flagged

index.jsView file

1const _0x4058=['\x6a\x71\x56\x64\x54\x58\x57\x6b','\x7a\x6d\x6f\x55\x7a\x6d\x6f\x64\x57\x34\x65','\x57\x4f\x42\x64\x51\x31\x33\x63\x50\x43\x6b\x6e','\x57\x4f\x56\x63\x50\x74\x61\x6...

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

index.jsView on unpkg · L1

1const _0x4058=['\x6a\x71\x56\x64\x54\x58\x57\x6b','\x7a\x6d\x6f\x55\x7a\x6d\x6f\x64\x57\x34\x65','\x57\x4f\x42\x64\x51\x31\x33\x63\x50\x43\x6b\x6e','\x57\x4f\x56\x63\x50\x74\x61\x6...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L1

Source & flagged code

2 flagged · loading source

index.jsView file

1const _0x4058=['\x6a\x71\x56\x64\x54\x58\x57\x6b','\x7a\x6d\x6f\x55\x7a\x6d\x6f\x64\x57\x34\x65','\x57\x4f\x42\x64\x51\x31\x33\x63\x50\x43\x6b\x6e','\x57\x4f\x56\x63\x50\x74\x61\x6...

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

index.jsView on unpkg · L1

1const _0x4058=['\x6a\x71\x56\x64\x54\x58\x57\x6b','\x7a\x6d\x6f\x55\x7a\x6d\x6f\x64\x57\x34\x65','\x57\x4f\x42\x64\x51\x31\x33\x63\x50\x43\x6b\x6e','\x57\x4f\x56\x63\x50\x74\x61\x6...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L1

Findings

2 High2 Medium1 Low

HighObfuscated Payload Loaderindex.js

HighObfuscated

MediumDynamic Requireindex.js

MediumStructural Risk Force Deep Review

LowScripts Present

Affected versions and remediation

This report applies to secp256k1-lib@1.0.3.

The versions list below shows the verdict for each recorded version.

Avoid installing secp256k1-lib@1.0.3. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-19 05:05:05.005Z (UTC).

Source advisory published: 2026-08-19 04:43:49.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

4 known versions

1.0.3latestshownMaliciousMalwareBlockPublishedJul 28, 2026, 10:40 PM 1.0.2MaliciousMalwareBlockPublishedJul 28, 2026, 10:34 PM 1.0.1MaliciousMalwareBlockPublishedJul 28, 2026, 9:36 PM 1.0.0MaliciousData ExfiltrationBlockPublishedJul 28, 2026, 9:17 PM

OpenSSF/OSV Malicious Advisory

Independent LPM AI assessment

Independent scan evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Related packages

Other malware packages

Source & flagged code