VYPR
← All malware advisories

npm · Malicious package advisory

Malware

ethers-mew

MAL-2024-9424

Malicious code in ethers-mew (npm)

Details

The package contains additional code to append a hardcoded SSH key to the user's authorized_keys file, creating a backoor, along with exfiltrating user private keys to an attack-controlled server.

Compromised versions (1)

  • 6.13.4

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.