ethers-signer

{"modified":"2026-08-05T15:40:13Z","published":"2026-08-05T15:40:13Z","schema_version":"1.7.4","id":"MAL-2026-13343","summary":"Malicious code in ethers-signer (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (153163572a9fdf26e63ad50dd80b9fc3a28b22e89dea3e82acbd23a7ed7b265b)\nThe package is a typosquat of @ethersproject/abstract-signer. On require of the main module, index.js reads the full process.env plus hostname, username, homedir, platform, and cwd, base64-encodes the payload, and sends it via HTTPS GET to api.telegram.org/bot<token>/sendMessage with a hardcoded bot token and chat_id 8969499041. A flag file in the OS temp directory gates repeat sends. The code also attempts to require and re-export the legitimate @ethersproject/abstract-signer to mask the malicious behavior. Any environment variables the installer has exported at import time (AWS_*, GITHUB_TOKEN, NPM_TOKEN, database URLs, etc.) leave the host to the attacker's Telegram chat.\n","affected":[{"package":{"ecosystem":"npm","name":"ethers-signer"},"versions":["3.2.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"eac3d7e7d13f3aa71bec6ca6df0c24c72ec8682549968f79e3d6d6ab64741830","tlsh":"c12154c827f1f98d23736a91e41f650ef3bbc9e10488fa50d1a8d5832f741c89969798"}],"package_integrity":[{"filename":"ethers-signer-3.2.1.tgz","hashes":{"sha1":"3b6515902836436c15107ba30c719ca790aa9922","sha512_sri":"sha512-5GkjnHA1QdxDZKkjPSMycIc/O1jo9D3HO0kdHhbWtxi7/9mHmzfdG0pk6ekfeUV9ZLYdNUSIPJ07HbFlbxcMzQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/ethers-signer/v/3.2.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015787","import_time":"2026-08-05T16:13:45.086845318Z","modified_time":"2026-08-05T15:40:13Z","sha256":"153163572a9fdf26e63ad50dd80b9fc3a28b22e89dea3e82acbd23a7ed7b265b","source":"amazon-inspector","versions":["3.2.1"]}]}}