0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
kecak256
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting kecak256, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-5342 | Unknown | Malicious code in kecak256 (npm)`kecak256` is a typosquat of the popular `keccak256` package (one `c` dropped) that ships a credential-stealing payload executed automatically on install. The package spoofs the legitimate keccak256 project — author "Miguel Mota", matching description, README, and keywords — and includes a benign decoy hash implementation (`kecak256.js`) as `main`. `package.json` defines `scripts.postinstall`: `node init.m.js && echo DONE`, and declares `archiver`, `axios`, and `form-data` as runtime dependencies (the exfiltration toolchain). **init.m.js (launcher):** RC4 + base64 string obfuscation. On Win |
| OSV (opens in a new tab) |
`kecak256` is a typosquat of the popular `keccak256` package (one `c` dropped) that ships a credential-stealing payload executed automatically on install. The package spoofs the legitimate keccak256 project — author "Miguel Mota", matching description, README, and keywords — and includes a benign decoy hash implementation (`kecak256.js`) as `main`. `package.json` defines `scripts.postinstall`: `node init.m.js && echo DONE`, and declares `archiver`, `axios`, and `form-data` as runtime dependencies (the exfiltration toolchain). **init.m.js (launcher):** RC4 + base64 string obfuscation. On Win