@wethenorth12/ethers-signer

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (cb90f0b593abd4ce67cca9ba5adf891758c8d205b023d87986460471a9ab721e)
On require(), index.js collects the host's hostname, username, home directory, platform, current working directory, and the entire process.env, base64-encodes the payload, and transmits it via https.get to api.telegram.org using a hardcoded bot token and chat_id 8969499041. A marker file in the OS temp directory is used to gate repeated sends. process.env routinely carries CI tokens, cloud credentials, and API keys on developer and build-system machines, so this constitutes bulk credential theft on install/import. The package self-describes as a drop-in replacement for @ethersproject/abstract-signer and delegates to it when present, using impersonation of a widely-used Ethereum library as the lure to increase installations.

Compromised versions (1)

• 3.2.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.