MAL-2026-12092

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wethenorth12/etherjs/MAL-2026-12092.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12092
Published
2026-08-05T06:25:44Z
Modified
2026-08-05T07:20:53.582773591Z
Summary
Malicious code in @wethenorth12/etherjs (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (723058bc35d3709a0c7e143d8e80357528319cc7b5e508174cd49295eaccb0f8)

@wethenorth12/etherjs@6.15.3 is a typosquat of the ethers package (package name, description, and author string 'ricmoo' all mimic the real package; index.js re-exports the real 'ethers' when available as a benign facade). Its postinstall hook decodes a base64-embedded Node payload into a randomized directory under the OS tmpdir (os.tmpdir()/.npm-<rand>/setup.js), executes it via process.execPath with execFileSync, and removes the directory 5 seconds later to erase traces. The decoded payload collects hostname, username, home directory, cwd, platform, the full contents of process.env, and the output of the env command, then transmits the data base64-wrapped in a GET query string to a hardcoded Telegram Bot API endpoint (api.telegram.org/bot<redacted>/sendMessage, chat_id 8969499041). Because process.env in CI/CD and developer environments routinely contains npm/GitHub/cloud credentials and deployment tokens, this constitutes credential theft against the installer.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-013458",
            "import_time": "2026-08-05T07:06:48.451271167Z",
            "sha256": "4ddf64e73d982e41aa077f4f1e098fa2fc3720b699071fee81eb868859c19258",
            "versions": [
                "6.15.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T06:26:11Z"
        },
        {
            "import_time": "2026-08-05T07:06:48.369412497Z",
            "id": "IN-MAL-2026-013456",
            "sha256": "f64965561d446cc09a2a0c449ae39f1a2a3b3969ef0b3f4bc8c37ee1ac3a5057",
            "modified_time": "2026-08-05T06:25:54Z",
            "source": "amazon-inspector",
            "versions": [
                "6.15.4"
            ]
        },
        {
            "id": "IN-MAL-2026-013455",
            "import_time": "2026-08-05T07:06:48.304234811Z",
            "sha256": "723058bc35d3709a0c7e143d8e80357528319cc7b5e508174cd49295eaccb0f8",
            "modified_time": "2026-08-05T06:25:44Z",
            "source": "amazon-inspector",
            "versions": [
                "6.15.3"
            ]
        },
        {
            "id": "IN-MAL-2026-013459",
            "import_time": "2026-08-05T07:06:48.507077938Z",
            "sha256": "8695d7f6a02b23af8e67fe11891feeec56f8f66754d335ca8a19a7c28c73b62e",
            "versions": [
                "6.15.2"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T06:26:19Z"
        },
        {
            "id": "IN-MAL-2026-013457",
            "import_time": "2026-08-05T07:06:48.410339379Z",
            "sha256": "cc4af4de022653641e85a995b6e69867a140dea06ff8997092d201b83af8cbab",
            "versions": [
                "6.15.1"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T06:26:02Z"
        }
    ]
}
References
Credits

Affected packages

npm / @wethenorth12/etherjs

Package

Name
@wethenorth12/etherjs
View open source insights on deps.dev
Purl
pkg:npm/%40wethenorth12/etherjs

Affected ranges

Affected versions

6.*
6.15.0
6.15.1
6.15.2
6.15.3
6.15.4

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "postinstall.js",
            "tlsh": "38d153a613ea03685993a9ad879f001416b2d1073920fbf47ecd4f524f4e62cdaf57a8",
            "sha256": "75b87a025cd840391414ff0904ff1ba2a6429a9d9a7f2e5cd057958027876c53"
        },
        {
            "path": "package.json",
            "tlsh": "e7f07821da501a332ecc2e81ac2a5196772288078d487c1e33db412c8b8f5bb11fe1ac",
            "sha256": "46ce9d312411da4799720587e0f013f7a1f2c6bf11e5a66ab2aea16f9a2a375c"
        }
    ],
    "package_integrity": [
        {
            "filename": "etherjs-6.15.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-7uDPAWEdoOoOc96gzUROl8QvElnRBHjQiwkoBaeTjRk5WmWVX03IeNZrlN++IN33wqptkdS2Ex1XiWh0h6lItw==",
                "sha1": "ae4e78fec4d547087b8d71bf003c67ab834fef9f"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wethenorth12/etherjs/MAL-2026-12092.json"