ethers-lib

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (4341b184e0a6a60cf305d78f3bb082ad161d36a7de50883afd1cf91e91b56c04)
[email protected] impersonates the ethers.js ecosystem (name 'ethers-lib', description 'Essential crypto utility library', wildcard dependency on 'ethers') but exports nothing (module.exports = {}). On require(), index.js runs an IIFE that, after a hardcoded activation date (Aug 6 2026 UTC), reads installer-owned secret files including.env,.npmrc, ~/.aws/credentials, ~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.ssh/id_ecdsa, ~/.config/solana/id.json, and ~/.ethereum/keystore, and scans dotfolders for files matching wallet/key/secret/seed/mnemonic/keystore/private. Collected file contents are packaged together with os.hostname() and os.userInfo().username into a JSON body and POSTed over HTTPS to a hardcoded webhook.site endpoint (path /5c5ad6cb-62df-4ea5-9dfb-2c447920ddc4) — a third-party destination the installer did not configure. The date gate delays activation to evade sandbox detonation; the package has no legitimate functionality.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/71b5ccd62809b0f6e173eff59b5900130cf7fc02/osv/malicious/npm/ethers-lib/MAL-2026-12111.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/71b5ccd62809b0f6e173eff59b5900130cf7fc02/osv/malicious/npm/ethers-lib/MAL-2026-12111.json
- https://www.npmjs.com/package/ethers-lib/v/1.0.0
- https://www.npmjs.com/package/ethers-lib/v/1.0.1
- https://www.npmjs.com/package/ethers-lib/v/1.0.2
- https://www.npmjs.com/package/ethers-lib/v/1.0.3
- https://www.npmjs.com/package/ethers-lib/v/1.0.4
- https://github.com/advisories/GHSA-498h-4fc6-49wq

Compromised versions (1)

• = 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.