MAL-2026-12111

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ethers-lib/MAL-2026-12111.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-12111

Published

2026-08-05T06:17:24Z

Modified

2026-08-05T07:21:11.723413965Z

Summary

Malicious code in ethers-lib (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (4341b184e0a6a60cf305d78f3bb082ad161d36a7de50883afd1cf91e91b56c04)

ethers-lib@1.0.4 impersonates the ethers.js ecosystem (name 'ethers-lib', description 'Essential crypto utility library', wildcard dependency on 'ethers') but exports nothing (module.exports = {}). On require(), index.js runs an IIFE that, after a hardcoded activation date (Aug 6 2026 UTC), reads installer-owned secret files including.env,.npmrc, ~/.aws/credentials, ~/.ssh/idrsa, ~/.ssh/ided25519, ~/.ssh/id_ecdsa, ~/.config/solana/id.json, and ~/.ethereum/keystore, and scans dotfolders for files matching wallet/key/secret/seed/mnemonic/keystore/private. Collected file contents are packaged together with os.hostname() and os.userInfo().username into a JSON body and POSTed over HTTPS to a hardcoded webhook.site endpoint (path /5c5ad6cb-62df-4ea5-9dfb-2c447920ddc4) — a third-party destination the installer did not configure. The date gate delays activation to evade sandbox detonation; the package has no legitimate functionality.

Database specific

{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T06:21:53Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-013429",
            "import_time": "2026-08-05T07:06:47.144076236Z",
            "sha256": "41ecdce3b18f465381c9bb40e2a39705464021c53bd8e6407259e89245383a0c",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "modified_time": "2026-08-05T06:17:24Z",
            "source": "amazon-inspector",
            "sha256": "4341b184e0a6a60cf305d78f3bb082ad161d36a7de50883afd1cf91e91b56c04",
            "import_time": "2026-08-05T07:06:45.569131448Z",
            "id": "IN-MAL-2026-013398",
            "versions": [
                "1.0.4"
            ]
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T06:20:09Z",
            "id": "IN-MAL-2026-013417",
            "import_time": "2026-08-05T07:06:46.613405673Z",
            "sha256": "713f2d42401ffc05451af5dcac5bbc3a3332d1546d0f9d8213ade20c07dda6d2",
            "versions": [
                "1.0.2"
            ]
        },
        {
            "modified_time": "2026-08-05T06:20:55Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-013422",
            "import_time": "2026-08-05T07:06:46.896521299Z",
            "sha256": "761487986f21fed24f8576a1dbc438ea33cba9918e6342b32673afeb32daad1c",
            "versions": [
                "1.0.1"
            ]
        },
        {
            "modified_time": "2026-08-05T06:19:07Z",
            "source": "amazon-inspector",
            "sha256": "8d43b5cdea21cc0769eb224ebcb43043b626cb970bea1d786c7b9f8fe647e5b5",
            "import_time": "2026-08-05T07:06:46.243211252Z",
            "id": "IN-MAL-2026-013410",
            "versions": [
                "1.0.3"
            ]
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com

Affected packages

npm / ethers-lib

Package

Name: ethers-lib; View open source insights on deps.dev
Purl: pkg:npm/ethers-lib

Affected ranges

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

Database specific

indicators

{
    "package_integrity": [
        {
            "filename": "ethers-lib-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-TSzU6rmZFcAgO7Ie0UlP0BcGOkn54DvjkiNJSU6q4oQeNvbzYg6NXzRdc1Fx0YdtSQC67BCohZ9jh8ZwgXEVAg==",
                "sha1": "9eff1a20516bd09cda600016068e925597434f72"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "153120e045e61630555736e8852b2200b173f29334469ec87acc5b118f1dc6846a7bfc",
            "sha256": "fe32f577c0be956d68eec04bf5a29f6cd3a3a495d638421ae4d9ef92f74f83c2",
            "path": "postinstall.js"
        },
        {
            "tlsh": "f4e0d810da115ef325dcaf95082e92875662480755447c2c73df849d874f37f04fe24d",
            "sha256": "a5dc372619cc69441d58c36765fe73b8aae7cdb0784ecfc88f00ea41e25c82c0",
            "path": "package.json"
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ethers-lib/MAL-2026-12111.json"

cwes

[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]