ethers-lib

{"modified":"2026-08-05T07:08:52Z","published":"2026-08-05T06:17:24Z","schema_version":"1.7.4","id":"MAL-2026-12111","summary":"Malicious code in ethers-lib (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4341b184e0a6a60cf305d78f3bb082ad161d36a7de50883afd1cf91e91b56c04)\nethers-lib@1.0.4 impersonates the ethers.js ecosystem (name 'ethers-lib', description 'Essential crypto utility library', wildcard dependency on 'ethers') but exports nothing (module.exports = {}). On require(), index.js runs an IIFE that, after a hardcoded activation date (Aug 6 2026 UTC), reads installer-owned secret files including.env,.npmrc, ~/.aws/credentials, ~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.ssh/id_ecdsa, ~/.config/solana/id.json, and ~/.ethereum/keystore, and scans dotfolders for files matching wallet/key/secret/seed/mnemonic/keystore/private. Collected file contents are packaged together with os.hostname() and os.userInfo().username into a JSON body and POSTed over HTTPS to a hardcoded webhook.site endpoint (path /5c5ad6cb-62df-4ea5-9dfb-2c447920ddc4) — a third-party destination the installer did not configure. The date gate delays activation to evade sandbox detonation; the package has no legitimate functionality.\n","affected":[{"package":{"ecosystem":"npm","name":"ethers-lib"},"versions":["1.0.0","1.0.4","1.0.2","1.0.1","1.0.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"postinstall.js","sha256":"fe32f577c0be956d68eec04bf5a29f6cd3a3a495d638421ae4d9ef92f74f83c2","tlsh":"153120e045e61630555736e8852b2200b173f29334469ec87acc5b118f1dc6846a7bfc"},{"path":"package.json","sha256":"a5dc372619cc69441d58c36765fe73b8aae7cdb0784ecfc88f00ea41e25c82c0","tlsh":"f4e0d810da115ef325dcaf95082e92875662480755447c2c73df849d874f37f04fe24d"}],"package_integrity":[{"filename":"ethers-lib-1.0.0.tgz","hashes":{"sha1":"9eff1a20516bd09cda600016068e925597434f72","sha512_sri":"sha512-TSzU6rmZFcAgO7Ie0UlP0BcGOkn54DvjkiNJSU6q4oQeNvbzYg6NXzRdc1Fx0YdtSQC67BCohZ9jh8ZwgXEVAg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/ethers-lib/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/ethers-lib/v/1.0.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/ethers-lib/v/1.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/ethers-lib/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/ethers-lib/v/1.0.3"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-013429","import_time":"2026-08-05T07:06:47.144076236Z","modified_time":"2026-08-05T06:21:53Z","sha256":"41ecdce3b18f465381c9bb40e2a39705464021c53bd8e6407259e89245383a0c","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-013398","import_time":"2026-08-05T07:06:45.569131448Z","modified_time":"2026-08-05T06:17:24Z","sha256":"4341b184e0a6a60cf305d78f3bb082ad161d36a7de50883afd1cf91e91b56c04","source":"amazon-inspector","versions":["1.0.4"]},{"id":"IN-MAL-2026-013417","import_time":"2026-08-05T07:06:46.613405673Z","modified_time":"2026-08-05T06:20:09Z","sha256":"713f2d42401ffc05451af5dcac5bbc3a3332d1546d0f9d8213ade20c07dda6d2","source":"amazon-inspector","versions":["1.0.2"]},{"id":"IN-MAL-2026-013422","import_time":"2026-08-05T07:06:46.896521299Z","modified_time":"2026-08-05T06:20:55Z","sha256":"761487986f21fed24f8576a1dbc438ea33cba9918e6342b32673afeb32daad1c","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-013410","import_time":"2026-08-05T07:06:46.243211252Z","modified_time":"2026-08-05T06:19:07Z","sha256":"8d43b5cdea21cc0769eb224ebcb43043b626cb970bea1d786c7b9f8fe647e5b5","source":"amazon-inspector","versions":["1.0.3"]}]}}