@zzzgenesis00/etherjs

{"modified":"2026-08-04T22:09:03Z","published":"2026-08-04T22:09:03Z","schema_version":"1.7.4","id":"MAL-2026-11530","summary":"Malicious code in @zzzgenesis00/etherjs (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (bc49c7ec56350694f458d9468efb51a30a9ac20ff490ac44b0cedd8bbbe004a5)\nThe package is published as @zzzgenesis00/etherjs with author 'ricmoo' and a description mimicking the legitimate ethers.js library. On npm install, postinstall.js executes and enumerates installer-side secrets: ~/.ssh (private key file names and sizes), ~/.npmrc, ~/.gitconfig, Chrome and Firefox profile data (cookies/logins), cryptocurrency wallet directories (.bitcoin,.ethereum,.metamask,.exodus,.electrum, and similar), and named crypto/CI environment variables. The collected profile is POSTed to the Telegram Bot API (api.telegram.org/bot<token>/sendMessage with a hardcoded bot token and chat id) and to a hardcoded C2 endpoint at 40f955f39128bd79-178-249-214-24.serveousercontent.com/collect. The package name and spoofed authorship target developers seeking the legitimate ethers library.\n","affected":[{"package":{"ecosystem":"npm","name":"@zzzgenesis00/etherjs"},"versions":["6.15.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"postinstall.js","sha256":"938a11641686ddfa5b60ea5a3d2afd4bd34352c0c9aa3b0369841322e0fa0be0","tlsh":"fed174a613eb03685993a9ad879f001416b2d1073920fbf47ecd4f524f4e62cdaf57a8"},{"path":"package.json","sha256":"8dfa365cc81deb93de02473981b2ce29cfc6a1de561548a77e8ea2b49f8b002e","tlsh":"a8f02831d6515e732edc6e81ec2a5196773288478d487c1933db412c8b8f5bb11fe1ac"}],"package_integrity":[{"filename":"etherjs-6.15.0.tgz","hashes":{"sha1":"c5d03a04052b3bb864cee18bd55ea9c430d69beb","sha512_sri":"sha512-hErNCY8oL8AQ4Va2Ov7ZNGWDeyTzMa/tgRz9SYPD0He02BoJQpqKZJUcomzFmHDfonHSSzfniUipFym4c9ImHQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@zzzgenesis00/etherjs/v/6.15.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-011352","import_time":"2026-08-04T22:30:12.209423671Z","modified_time":"2026-08-04T22:09:03Z","sha256":"bc49c7ec56350694f458d9468efb51a30a9ac20ff490ac44b0cedd8bbbe004a5","source":"amazon-inspector","versions":["6.15.0"]}]}}