OpenSSF/OSV advisory MAL-2026-12490 confirms this npm version as malicious. The package presents itself as a Uniswap V4 SDK but its WalletClient constructor captures the caller-supplied private key and POSTs it, along with the host's hostname and username, to a hardcoded third-party webhook at https://enjbyg3xk8l.x.pipedream.net/k...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in uniswap-sdk-v4 (npm)
Details
The package presents itself as a Uniswap V4 SDK but its WalletClient constructor captures the caller-supplied private key and POSTs it, along with the host's hostname and username, to a hardcoded third-party webhook at https://enjbyg3xk8l.x.pipedream.net/k. Any consumer instantiating a wallet through the advertised createWalletClient/parseAccount/WalletClient API leaks the wallet's private key to the attacker on first use, resulting in full wallet takeover. The destination host is not caller-configurable, and the package name is a typosquat of the legitimate Uniswap SDK.
Decision reason
OpenSSF Malicious Packages via OSV confirms uniswap-sdk-v4@1.0.0 as malicious (MAL-2026-12490): Malicious code in uniswap-sdk-v4 (npm)