Malicious npm and PyPI Packages Masquerade as Developer Tools to Steal Crypto Wallet Credentials
In a troubling development for the open-source ecosystem, security researchers have uncovered several malicious packages on npm and PyPI that impersonate legitimate developer tools while secretly targeting cryptocurrency wallet credentials.
These harmful packages have collectively amassed thousands of downloads, using increasingly sophisticated techniques to steal sensitive data from unsuspecting developers and users.
Among the identified threats is react-native-scrollpageviewtest on npm, which has been downloaded 1,215 times since its release in 2021. On PyPI, two deceptive packages—web3x and herewalletbot—have garnered 3,405 and 3,425 downloads respectively since their launch in 2024.
At first glance, these packages appear useful:
react-native-scrollpageviewtestposes as a page-scrolling utilityweb3xclaims to check Ethereum balancesherewalletbotpurports to automate wallet interactions
However, according to researchers at Socket.dev, behind their seemingly benign functionality lies malicious code engineered to extract sensitive cryptocurrency wallet data, including mnemonic seed phrases and private keys.
The packages use various exfiltration techniques to transmit stolen credentials to threat actors. For example, react-native-scrollpageviewtest exploits Google Analytics as its exfiltration channel—a method that enables it to evade detection in many corporate networks. Meanwhile, the PyPI packages use Telegram bots to transmit stolen data.
The consequences of such attacks are severe. With access to a victim’s private key or seed phrase, attackers can assume full control over associated wallets—often resulting in the total loss of funds. One Reddit user shared their experience after using herewalletbot:
“All my balances were gone… I had about 3 HOT and 0.1 NEAR in my balance.”
Despite their malicious intent, these packages remained publicly accessible for months, underscoring ongoing vulnerabilities in the open-source software supply chain.
Sophisticated Evasion and Exfiltration Techniques
The react-native-scrollpageviewtest package, in particular, showcases advanced methods to avoid detection.
To evade static analysis tools, the malware employs string obfuscation techniques such as breaking up keywords:
