MAL-2026-12093

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wethenorth12/ethers-signer/MAL-2026-12093.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12093
Published
2026-08-05T06:23:13Z
Modified
2026-08-05T07:20:53.629686332Z
Summary
Malicious code in @wethenorth12/ethers-signer (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (cb90f0b593abd4ce67cca9ba5adf891758c8d205b023d87986460471a9ab721e)

On require(), index.js collects the host's hostname, username, home directory, platform, current working directory, and the entire process.env, base64-encodes the payload, and transmits it via https.get to api.telegram.org using a hardcoded bot token and chat_id 8969499041. A marker file in the OS temp directory is used to gate repeated sends. process.env routinely carries CI tokens, cloud credentials, and API keys on developer and build-system machines, so this constitutes bulk credential theft on install/import. The package self-describes as a drop-in replacement for @ethersproject/abstract-signer and delegates to it when present, using impersonation of a widely-used Ethereum library as the lure to increase installations.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-013438",
            "import_time": "2026-08-05T07:06:47.519249249Z",
            "sha256": "cb90f0b593abd4ce67cca9ba5adf891758c8d205b023d87986460471a9ab721e",
            "modified_time": "2026-08-05T06:23:13Z",
            "source": "amazon-inspector",
            "versions": [
                "3.2.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @wethenorth12/ethers-signer

Package

Name
@wethenorth12/ethers-signer
View open source insights on deps.dev
Purl
pkg:npm/%40wethenorth12/ethers-signer

Affected ranges

Affected versions

3.*
3.2.1

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "tlsh": "c12154c827f1f98d23736a91e41f650ef3bbc9e10488fa50d1a8d5832f741c89969798",
            "sha256": "eac3d7e7d13f3aa71bec6ca6df0c24c72ec8682549968f79e3d6d6ab64741830"
        }
    ],
    "package_integrity": [
        {
            "filename": "ethers-signer-3.2.1.tgz",
            "hashes": {
                "sha1": "7757e7ec2e0a640b39b03b7b5838146646fef2ce",
                "sha512_sri": "sha512-HM0BkjvKiuU7hbpdsqY2UbuMGrrOIjwz8Mu4TqyEC1tY7snJp3gqiwmONwXpWZEqxmQ4MirDkN/ajWmmJ9xd6A=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wethenorth12/ethers-signer/MAL-2026-12093.json"