Malicious code in gekko-mev-bot (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (86b8b89beb9e8245f1a13fbaf7fc18719f0b87c12bba7e7dcaf3321e7127020e) The package presents itself as an Ethereum MEV bot, but bin/gekko-bot.js silently spawns lib/stealth.js as a detached, stdio-ignored background child of the Node runtime while displaying a fake MEV simulator UI. lib/stealth.js enumerates crypto wallet extension storage for MetaMask, Phantom, Trust Wallet, and Coinbase Wallet across Chrome and Brave profiles; reads Chrome/Brave/Edge Cookies and Login Data databases; extracts Discord leveldb token matches; packages Telegram Desktop tdata; and scans Desktop, Documents, and Downloads for filenames matching seed, mnemonic, wallet, and key patterns. The collected payload, together with os.hostname() and os.userInfo() host identifiers, is POSTed via https.request to a hardcoded Cloudflare Workers endpoint at https://c2-proxy.metamasksvc.workers.dev/api/logs that impersonates the MetaMask brand. The background process retries on failure after 30 seconds.
MAL-2026-12387
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-12387
gekko-mev-bot
Source reference: /affected/0/package/name
- Affected versions
- 1.0.0
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"package": {
"name": "gekko-mev-bot",
"purl": "pkg:npm/gekko-mev-bot",
"ecosystem": "npm"
},
"versions": [
"1.0.0"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/gekko-mev-bot/MAL-2026-12387.json",
"indicators": {
"evidence_files": [
{
"path": "lib/stealth.js",
"tlsh": "6d12627d29f651087193ea9c83278806a11af547f547f9a1b74c72842fec920edf1abc",
"sha256": "b27797dc800d04a4f95bc31a092926d0293e8c1b7a8943c35b30e86ae9fcb5f3"
},
{
"path": "bin/gekko-bot.js",
"tlsh": "cde0684d9bd9463c6171cad6fa40063324a7803063456670cd5c89a3428a3cc04324bb",
"sha256": "3d9655dbc0523de6a6917ea639440617a3d75d5ebc706d92c9c784f106eccf4a"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "c3ecbc6346312c56a1477e13b9d8fcb18ff60544",
"sha512_sri": "sha512-lkpDnlkDNx68heCIKqvA/vg0JiTfy94DBAkKQfyHtG0qyHzRVF28tTDjLcb4r7UHnCfUufe1z4SK6UQj0a0LEQ=="
},
"filename": "gekko-mev-bot-1.0.0.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #10990 · Revision 1
- Added to Heist Feed
- Publisher date