eth-react-provider @1.0.0
Vulnerability report · Last retrieved from osv.dev August 19, 2026 at 11:52 AM UTC
OSV ID
MAL-2026-14300
Ecosystem
npm
Summary
The package advertises itself as a React Ethereum provider exporting EthereumProvider/useProvider/useSigner/useNetwork hooks, but the shipped main entry lib/index.js contains web3.js Subscriptions code plus a large obfuscated payload wrapped in a Function("ObbvO95", "...") constructor that is invoked at module load. The payload uses randomized hex-named identifiers, a signed-integer decode table, and a doubly-unicode-escaped string body to hide its behavior from static inspection. Any consumer that require('eth-react-provider') executes this opaque code in the installer's process. The src/index.js in the tarball contains the clean web3.js source without this payload, indicating the built artifact was tampered. The README/code mismatch (documented React hook API vs. actual web3.js Subscriptions plus loader) is consistent with a trojanized lookalike package rather than a broken release.
Source: amazon-inspector (7b9bdf79a694cbf6d1a840541b4c47fdac8dc6ac32f4b6a3d4887d5f81233387)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.