VYPR
← All malware advisories

npm · Malicious package advisory

Malware

ethers-web3

MAL-2024-9425

Malicious code in ethers-web3 (npm)

Details

The package contains additional code to append a hardcoded SSH key to the user's authorized_keys file, creating a backoor, along with exfiltrating user private keys to an attack-controlled server.

Compromised versions (2)

  • 6.13.5
  • 6.13.4

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.