Malicious code in ethers-common (npm)
The npm package ethers-common v1.0.0 contained malicious code that executed arbitrary commands during installation via a postinstall hook. The package impersonated the legitimate ethers Web3 library and used a base64-obfuscated URL to fetch and execute attacker-controlled code over plain HTTP.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed ethers-common version 1.0.0
- Ecosystems
- Attack vectors
- Affected entities
- ethers-common · 1.0.0
The npm package ethers-common v1.0.0 was identified as malicious by both Amazon Inspector and the OpenSSF Package Analysis project. The package contained a postinstall hook in package.json that base64-decoded a URL (http://8.217.75.147:3000/payload), fetched the payload via curl over plain HTTP, and piped the response directly into bash for execution.
The package itself was a hollow lure designed to impersonate the well-known ethers Web3 library, with a deceptive description ("Utilities for Web3/ethers development") to bait installations. The index.js file exported only an empty object, serving no legitimate functionality.
The attack chain combined multiple obfuscation and evasion techniques: a bare IP address for command-and-control, unencrypted HTTP transport, base64-encoded URL obfuscation, and execution of arbitrary code at npm install time with no integrity verification. This represents a classic supply-chain attack targeting developers installing what they believed to be a legitimate utility library.
The package has been identified and cataloged by the OpenSSF malicious packages database (MAL-2026-3707).
Indicators of compromise
- Packages
- ethers-common
- IPs
- 8.217.75.147
Remediation
- Immediately uninstall ethers-common v1.0.0 from all systems
- Audit npm install logs and process history for any suspicious activity during the installation window
- Review and revoke any credentials or secrets that may have been exposed on affected machines
- Use the legitimate ethers library (published by the ethers.js team) instead of ethers-common
- Enable npm audit and consider using npm's malicious package detection features
- Monitor for any outbound connections to 8.217.75.147:3000 or related infrastructure
Sources
- GitHub Advisory GHSA-853h-mq9w-93p4 · GitHub Advisory Database
Cite this entry
"Malicious code in ethers-common (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-ethers-common-npm-1uiark
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in exxpress-utils (npm)
The npm package exxpress-utils contained malicious code in a postinstall script that harvested npm/AWS/GitHub credentials, scanned for cryptocurrency wallet extensions, and exfiltrated sensitive files to a hardcoded C2 server. The package was a typosquat of the legitimate 'express' package.
npmCompromised packageTyposquatting - containedcritical
Malicious code in hardhat-core (npm)
The npm package hardhat-core v1.0.0 is a typosquat of the legitimate hardhat package that executes a malicious postinstall script. The script base64-decodes a URL, fetches a payload over plain HTTP from a hardcoded IP address, and pipes it directly into bash, executing arbitrary attacker-controlled code during installation.
npmTyposquattingCompromised package - containedcritical
Malicious code in prisma-callback (npm)
prisma-callback@1.0.3 is a typosquatting package impersonating the legitimate Prisma ORM. It contains a preinstall script that executes undeclared, opaque native Go binaries (prisma-amd64 or prisma-arm64) at install time without integrity verification.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in prettier-lint-lenz (npm)
The npm package prettier-lint-lenz is a malicious imposter of the legitimate Prettier formatter. It executes a postinstall script that deploys clipboard-stealing malware on Windows systems, establishing persistence via a scheduled task that exfiltrates clipboard contents to a hardcoded C2 server.
npmCompromised packageTyposquatting