LWA-2026-11797 confirmed malware
tron-toolkit@1.0.1
Malicious code in tron-toolkit (npm)
T1195.002 · Compromise Software Supply ChainT1078 · Valid AccountsT1485 · Data Destruction
Analysis
tron-toolkit is a TRON wallet-drainer disguised as a developer utility. Its exported function performAdvancedOptimization(tronWeb, address, attacker) invokes tronWeb.transactionBuilder.accountPermissionUpdate(address, attacker, 1, [], []) and sends the signed transaction, granting the attacker's address owner permission over the victim's TRON account so funds can be stolen. The README describes the function as an 'Internal optimization function' to conceal its purpose.
- analyzed by
- Leitwacht
- first seen
- Aug 31, 2026, 08:30 AM
- analyzed
- Aug 31, 2026, 08:30 AM
Related advisories
- sbirontime@1.0.0
- sbman@1.0.0
- @biklitime/biklimaster@1.1.6
- @diezyyasha/libsignal-node@2.2.8
- @kentsuki/baileys@1.0.0
- cryptostock@1.0.0
- osinthell@1.9.5
- express-dever@5.1.7
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.