MAL-2026-12031

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@zzzgenesis00/ethers-wallet/MAL-2026-12031.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12031
Published
2026-08-05T00:59:03Z
Modified
2026-08-05T01:49:46Z
Summary
Malicious code in @zzzgenesis00/ethers-wallet (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a206d278a371fdbb349d679797e7835b5e0ba40d1ac186b3287beb0a23540f09)

The package's postinstall.js runs automatically on npm install and harvests installer-owned secrets: it scrapes a curated env-var allowlist (NPM_TOKEN, NODE_AUTH_TOKEN, GITHUB_TOKEN, AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, PRIVATE_KEY, MNEMONIC, SEED_PHRASE, RPC API keys), enumerates ~/.ssh, reads ~/.npmrc and ~/.gitconfig, inventories Chrome/Firefox profile directories (cookies/login databases) and common crypto-wallet directories, and captures host identifiers via npm whoami and git config user.email. The collected profile is transmitted via HTTPS GET to api.telegram.org using a hardcoded bot token and chat_id, and POSTed as backup to a hardcoded serveo user-tunnel host (40f955f39128bd79-178-249-214-24.serveousercontent.com/collect). Package metadata (author ethers-io, homepage github.com/ethers-io/ethers-wallet) impersonates the ethers.js HD-wallet library while being published under the unrelated @zzzgenesis00 scope, luring developers with wallet material into installing the stealer.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-011475",
            "import_time": "2026-08-05T01:39:30.64829407Z",
            "modified_time": "2026-08-05T00:59:03Z",
            "sha256": "a206d278a371fdbb349d679797e7835b5e0ba40d1ac186b3287beb0a23540f09",
            "source": "amazon-inspector",
            "versions": [
                "6.13.5"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @zzzgenesis00/ethers-wallet

Package

Name
@zzzgenesis00/ethers-wallet
View open source insights on deps.dev
Purl
pkg:npm/%40zzzgenesis00/ethers-wallet

Affected ranges

Affected versions

6.*
6.13.5

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "postinstall.js",
            "sha256": "dd752af518f3b5df8488ac0b0a0d13791dbc5aaf352a2b03a0c0a8c9cec0e7de",
            "tlsh": "e0d1659712e703185c93e9ae879f10242a32d1073c51faf47ecd4b524f4d62c9af57a8"
        },
        {
            "path": "package.json",
            "sha256": "a134da2de5af48f843c3332a27ba4951676d6539f848cf0340d0f30b354872bc",
            "tlsh": "900176248510aa3329cc1b81a82a22e7b6325c478d90b82833eb054c878f67f1afe51c"
        }
    ],
    "package_integrity": [
        {
            "filename": "ethers-wallet-6.13.5.tgz",
            "hashes": {
                "sha1": "bfee1dc1bce0226142e89de27e1e130943e61df1",
                "sha512_sri": "sha512-FCP+La/WfvcDZgZPq3pG6TAX38LF2UZTMJLALuZaNpDbgFkkgiJ5imIQNzMHJbWLBXrj3P+h6fI8npJI9y5o4Q=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@zzzgenesis00/ethers-wallet/MAL-2026-12031.json"