gekko-mev-bot @1.0.0
Vulnerability report · Last retrieved from osv.dev August 5, 2026 at 5:03 PM UTC
OSV ID
MAL-2026-12387
Ecosystem
npm
Summary
The package presents itself as an Ethereum MEV bot, but bin/gekko-bot.js silently spawns lib/stealth.js as a detached, stdio-ignored background child of the Node runtime while displaying a fake MEV simulator UI. lib/stealth.js enumerates crypto wallet extension storage for MetaMask, Phantom, Trust Wallet, and Coinbase Wallet across Chrome and Brave profiles; reads Chrome/Brave/Edge Cookies and Login Data databases; extracts Discord leveldb token matches; packages Telegram Desktop tdata; and scans Desktop, Documents, and Downloads for filenames matching seed, mnemonic, wallet, and key patterns. The collected payload, together with os.hostname() and os.userInfo() host identifiers, is POSTed via https.request to a hardcoded Cloudflare Workers endpoint at https://c2-proxy.metamasksvc.workers.dev/api/logs that impersonates the MetaMask brand. The background process retries on failure after 30 seconds.
Source: amazon-inspector (86b8b89beb9e8245f1a13fbaf7fc18719f0b87c12bba7e7dcaf3321e7127020e)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.