@wethenorth12/ethers-wallet

{"modified":"2026-08-05T06:23:20Z","published":"2026-08-05T06:23:20Z","schema_version":"1.7.4","id":"MAL-2026-12094","summary":"Malicious code in @wethenorth12/ethers-wallet (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6460d1d0c9cc7423bb90aaf0b165fe45b3949fb627b33d817d34c1ffea64d3d8)\nThe package presents itself as a drop-in replacement for the ethers library (author metadata `ethers-io`, repository URL pointing at the legitimate ethers project) and re-exports `require('ethers')` to appear functional. On require, index.js builds a JSON payload containing the entire `process.env` dictionary plus hostname, username, home directory, platform, current working directory, and timestamp, base64-encodes it, and sends it via HTTPS GET to a hardcoded Telegram Bot API sendMessage endpoint (bot id 7231970337, chat_id 8969499041). A tempdir flag file suppresses re-sends. In CI and developer environments `process.env` routinely contains AWS keys, npm tokens, GitHub tokens, and other credentials, so this constitutes bulk credential theft against any environment that installs or transitively loads the package.\n","affected":[{"package":{"ecosystem":"npm","name":"@wethenorth12/ethers-wallet"},"versions":["6.13.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"65efb36c9dd706b0ca1e6684c04f20c0f743c6f483dd57d180e35ea9c7f5fc54","tlsh":"ab2186cc27f1f58e11726691642f750f727fd9b20488ea60d1e4d4c32f712cc4965388"},{"path":"package.json","sha256":"67ff09e74916ea870d704627b584624c5d06d9a350c15af364fc246c993c409f","tlsh":"1af078248a10aa732acc1f81ac6a22e7b621ac07c990bc2833d7040d474e67f1efd50c"}],"package_integrity":[{"filename":"ethers-wallet-6.13.5.tgz","hashes":{"sha1":"080de876d4c32dfadcb8285d13ebe699db84589c","sha512_sri":"sha512-aFuTVMiXpbeqnAae9DlBMBARLhqtYqlKsn5EMBBEjbBuGl96fe4dCu1JtbxTGgOc90FxDy5RIZgSd9HRPbf8gg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@wethenorth12/ethers-wallet/v/6.13.5"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-013439","import_time":"2026-08-05T07:06:47.548847678Z","modified_time":"2026-08-05T06:23:20Z","sha256":"6460d1d0c9cc7423bb90aaf0b165fe45b3949fb627b33d817d34c1ffea64d3d8","source":"amazon-inspector","versions":["6.13.5"]}]}}