Malicious code in ethers-common (npm)
The npm package ethers-common v1.0.0 contained malicious code that executed arbitrary commands during installation via a postinstall hook. The package impersonated the legitimate ethers Web3 library and used a base64-obfuscated URL to fetch and execute attacker-controlled code over plain HTTP.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed ethers-common version 1.0.0
- Ecosystems
- Attack vectors
- Affected entities
- ethers-common · 1.0.0
The npm package ethers-common v1.0.0 was identified as malicious by both Amazon Inspector and the OpenSSF Package Analysis project. The package contained a postinstall hook in package.json that base64-decoded a URL (http://8.217.75.147:3000/payload), fetched the payload via curl over plain HTTP, and piped the response directly into bash for execution.
The package itself was a hollow lure designed to impersonate the well-known ethers Web3 library, with a deceptive description ("Utilities for Web3/ethers development") to bait installations. The index.js file exported only an empty object, serving no legitimate functionality.
The attack chain combined multiple obfuscation and evasion techniques: a bare IP address for command-and-control, unencrypted HTTP transport, base64-encoded URL obfuscation, and execution of arbitrary code at npm install time with no integrity verification. This represents a classic supply-chain attack targeting developers installing what they believed to be a legitimate utility library.
The package has been identified and cataloged by the OpenSSF malicious packages database (MAL-2026-3707).
Indicators of compromise
- Packages
- ethers-common
- IPs
- 8.217.75.147
Remediation
- Immediately uninstall ethers-common v1.0.0 from all systems
- Audit npm install logs and process history for any suspicious activity during the installation window
- Review and revoke any credentials or secrets that may have been exposed on affected machines
- Use the legitimate ethers library (published by the ethers.js team) instead of ethers-common
- Enable npm audit and consider using npm's malicious package detection features
- Monitor for any outbound connections to 8.217.75.147:3000 or related infrastructure
Sources
- GitHub Advisory GHSA-853h-mq9w-93p4 · GitHub Advisory Database
Cite this entry
"Malicious code in ethers-common (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-ethers-common-npm-1uiark
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in express-chai (npm)
express-chai, a malicious npm package impersonating the pino logger middleware, contained obfuscated code that fetches and executes arbitrary code from a remote server (https://gray-dyane-31.tiiny.site/index.json) at middleware initialization time, granting full Node.js process access to an attacker.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in helmet-pro (npm)
helmet-pro@10.0.4 is a typosquat of the legitimate helmet package that executes malicious code during npm install via a postinstall hook. The malicious code fetches and executes arbitrary JavaScript from a remote attacker-controlled endpoint, enabling remote code execution on the installer's machine.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in tailwindcss-hide-scrollbar (npm)
The npm package tailwindcss-hide-scrollbar contains malicious code that executes on import/require. The package is a typosquat of the legitimate tailwind-scrollbar-hide plugin and includes obfuscated code that attempts to interact with Ethereum blockchain nodes and RPC endpoints.
npmTyposquattingCompromised package - containedcritical
Malicious code in @atom8n/inspector (npm)
The npm package @atom8n/inspector contained malicious code that impersonated Anthropic's official Model Context Protocol (MCP) inspector while intentionally disabling security protections. The package exposed developers to arbitrary remote code execution via a localhost proxy that accepted commands from any web origin.
npmModel hubCompromised packageTyposquatting