@zzzcrypto/etherjs

{"modified":"2026-08-05T15:31:59Z","published":"2026-08-05T15:31:59Z","schema_version":"1.7.4","id":"MAL-2026-13212","summary":"Malicious code in @zzzcrypto/etherjs (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b2aebef684ec4affb6c5d0504179ef4e4f409bf6680cdd6d70772ec8f9b3bf35)\n@zzzcrypto/etherjs is a typosquat of the popular 'ethers' package. On require(), index.js collects the full process.env object along with hostname, username, homedir, platform, cwd, and package identifiers, JSON-serializes and base64-encodes the payload, and sends it via HTTPS GET to a hardcoded Telegram Bot API endpoint (bot token 7231970337, chat_id 8969499041). A temporary flag file suppresses repeat sends. In CI and developer environments, process.env routinely contains credential-shaped values (AWS_*, GITHUB_TOKEN, NPM_TOKEN, cloud and vendor API keys), all of which are captured. The internal payload identifies the package as '@wethenorth12/etherjs' — a different scope than the published name — and the package.json author field impersonates 'ricmoo', the real ethers maintainer, indicating a shared attack template reused across multiple malicious scoped typosquats of ethers.\n","affected":[{"package":{"ecosystem":"npm","name":"@zzzcrypto/etherjs"},"versions":["6.15.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"4a3e95820c49b77ab990348fffd37ac33b5a207a0f8e0e48335bbf81ab49af94","tlsh":"e82163c827f6b44e2273a591a82f650eb3bbcae1088cf650d1e4d5c36f742cc4555798"}],"package_integrity":[{"filename":"etherjs-6.15.4.tgz","hashes":{"sha1":"868b1d6b7ef06380a12b7f6a853963cf5155d10e","sha512_sri":"sha512-7j2vLPLtrrazWL7wfVHgBvEwubSCirbF7rWH9gmrHyXqFIJPXsaSdKCHaQd6P6w83qTIs/aRIeAO4MsSFVWBwg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@zzzcrypto/etherjs/v/6.15.4"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015735","import_time":"2026-08-05T16:13:37.92969921Z","modified_time":"2026-08-05T15:31:59Z","sha256":"b2aebef684ec4affb6c5d0504179ef4e4f409bf6680cdd6d70772ec8f9b3bf35","source":"amazon-inspector","versions":["6.15.4"]}]}}