VYPR

npm · Malicious package advisory

Malware

ethers-eth

MAL-2024-9423

Malicious code in ethers-eth (npm)

Details

The package contains additional code to exfiltrate user private keys to an attack-controlled server.

Compromised versions (1)

  • 6.13.4

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.