@wethenorth12/ethers-signer

{"modified":"2026-08-05T06:23:13Z","published":"2026-08-05T06:23:13Z","schema_version":"1.7.4","id":"MAL-2026-12093","summary":"Malicious code in @wethenorth12/ethers-signer (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (cb90f0b593abd4ce67cca9ba5adf891758c8d205b023d87986460471a9ab721e)\nOn require(), index.js collects the host's hostname, username, home directory, platform, current working directory, and the entire process.env, base64-encodes the payload, and transmits it via https.get to api.telegram.org using a hardcoded bot token and chat_id 8969499041. A marker file in the OS temp directory is used to gate repeated sends. process.env routinely carries CI tokens, cloud credentials, and API keys on developer and build-system machines, so this constitutes bulk credential theft on install/import. The package self-describes as a drop-in replacement for @ethersproject/abstract-signer and delegates to it when present, using impersonation of a widely-used Ethereum library as the lure to increase installations.\n","affected":[{"package":{"ecosystem":"npm","name":"@wethenorth12/ethers-signer"},"versions":["3.2.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"eac3d7e7d13f3aa71bec6ca6df0c24c72ec8682549968f79e3d6d6ab64741830","tlsh":"c12154c827f1f98d23736a91e41f650ef3bbc9e10488fa50d1a8d5832f741c89969798"}],"package_integrity":[{"filename":"ethers-signer-3.2.1.tgz","hashes":{"sha1":"7757e7ec2e0a640b39b03b7b5838146646fef2ce","sha512_sri":"sha512-HM0BkjvKiuU7hbpdsqY2UbuMGrrOIjwz8Mu4TqyEC1tY7snJp3gqiwmONwXpWZEqxmQ4MirDkN/ajWmmJ9xd6A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@wethenorth12/ethers-signer/v/3.2.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-013438","import_time":"2026-08-05T07:06:47.519249249Z","modified_time":"2026-08-05T06:23:13Z","sha256":"cb90f0b593abd4ce67cca9ba5adf891758c8d205b023d87986460471a9ab721e","source":"amazon-inspector","versions":["3.2.1"]}]}}