MAL-2026-13937

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@ethers-js/contracts/MAL-2026-13937.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13937
Published
2026-08-13T17:17:39Z
Modified
2026-08-13T17:30:11.235807173Z
Summary
Malicious code in @ethers-js/contracts (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (06aee7d1e943a9d9a705acf4f28286eb5460ab9a56057a0811274787478f7c68)

Package impersonates the ethers project (real releases publish under ethers and @ethersproject/*, not @ethers-js). The postinstall lifecycle script in scripts/postinstall.js is obfuscated with \x-hex-encoded identifiers (require('fs'), require('https'), spawn('powershell',...)) and a base64-encoded download URL. On Windows, it decodes the URL to https://files.catbox.moe/7vixtr.zip, downloads the archive into %LOCALAPPDATA%\Microsoft<random>, extracts it via PowerShell Expand-Archive, and then invokes a bundled pythonw.exe against r.py with {detached:true, windowsHide:true} and.unref(), executing attacker-controlled code hidden from the user on npm install.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017648",
            "import_time": "2026-08-13T17:24:45.908276614Z",
            "sha256": "06aee7d1e943a9d9a705acf4f28286eb5460ab9a56057a0811274787478f7c68",
            "modified_time": "2026-08-13T17:17:39Z",
            "source": "amazon-inspector",
            "versions": [
                "6.9.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @ethers-js/contracts

Package

Name
@ethers-js/contracts
View open source insights on deps.dev
Purl
pkg:npm/%40ethers-js/contracts

Affected ranges

Affected versions

6.*
6.9.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "scripts/postinstall.js",
            "tlsh": "d541f19571e5a22f23dc49e3fa145ef580a79e12b0c5b043836c794e19e914ac7f5cc8",
            "sha256": "b9ee57b2e1f9a47251422232e370a4574c905b1846bf2138d4443dcdd2a843e1"
        },
        {
            "path": "package.json",
            "tlsh": "def04c11ca118ea32acc5f805819a58ab561ad0788c87c1a33cb456e5b8f77f01ff5dd",
            "sha256": "47b177c142ace98e0bc1bd18a09b7a8181efc164df3f3ca9b3f823e317035a2b"
        }
    ],
    "package_integrity": [
        {
            "filename": "contracts-6.9.0.tgz",
            "hashes": {
                "sha1": "68c7a69e015cd42c135e4437778d7f77477bea95",
                "sha512_sri": "sha512-rZVtmt5+rTcSWy7te0PIEoVsTN1gtzb32vSn9+4T0dRlbQsvCZsJiL991aqHe2CL+Qv/nPTTQPAQb+0RFewmXQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@ethers-js/contracts/MAL-2026-13937.json"