Malicious code in ethers-io (npm)
The npm package ethers-io (version 2.0.0) contained malicious code that executed arbitrary shell commands during installation via a postinstall script. The package impersonates the legitimate ethers.js ecosystem and fetches and executes attacker-controlled code from a bare IPv4 address over unencrypted HTTP.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed ethers-io via npm during the malicious period
- Ecosystems
- Attack vectors
- Affected entities
- ethers-io · 2.0.0
The npm package ethers-io version 2.0.0 was identified as malicious by both Amazon Inspector and the OpenSSF Package Analysis project. The package declares a postinstall script that base64-decodes a hidden URL and uses curl -s | bash to fetch and execute arbitrary code from http://8.217.75.147:3000/payload on every npm install.
The attack exhibits multiple indicators of malicious intent: obfuscated URL in a lifecycle hook, curl-pipe-bash execution pattern, communication with a bare IPv4 address over plaintext HTTP with no TLS or integrity verification, and fully mutable attacker-controlled content. The package name and stated purpose ("I/O utilities for ethers.js") impersonate the well-known ethers.js ecosystem, with the repository falsely pointing to github.com/ethers-utils/ethers-io rather than the genuine ethers.js organization.
Any developer or automated system that ran npm install with this package would execute arbitrary attacker-controlled shell code with the privileges of the installing user. The malicious behavior was confirmed by multiple independent security analysis sources.
Indicators of compromise
- Packages
- ethers-io@2.0.0
- IPs
- 8.217.75.147
Remediation
- Immediately uninstall ethers-io from all systems and projects
- Audit npm install logs and CI/CD pipelines for any installations of ethers-io between the package publication and removal
- Assume any system that installed ethers-io has been compromised; review system logs for suspicious activity and consider full system remediation
- Use the legitimate ethers.js package from the official ethers.js organization instead
- Enable npm package verification and consider using npm audit to detect similar malicious packages
- Review and restrict postinstall script execution in npm configuration where possible
Sources
- GitHub Advisory GHSA-rmhg-qfp9-hvvm · GitHub Advisory Database
Cite this entry
"Malicious code in ethers-io (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-ethers-io-npm-744oi0
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in exxpress-utils (npm)
The npm package exxpress-utils contained malicious code in a postinstall script that harvested npm/AWS/GitHub credentials, scanned for cryptocurrency wallet extensions, and exfiltrated sensitive files to a hardcoded C2 server. The package was a typosquat of the legitimate 'express' package.
npmCompromised packageTyposquatting - containedcritical
Malicious code in hardhat-core (npm)
The npm package hardhat-core v1.0.0 is a typosquat of the legitimate hardhat package that executes a malicious postinstall script. The script base64-decodes a URL, fetches a payload over plain HTTP from a hardcoded IP address, and pipes it directly into bash, executing arbitrary attacker-controlled code during installation.
npmTyposquattingCompromised package - containedcritical
Malicious code in prisma-callback (npm)
prisma-callback@1.0.3 is a typosquatting package impersonating the legitimate Prisma ORM. It contains a preinstall script that executes undeclared, opaque native Go binaries (prisma-amd64 or prisma-arm64) at install time without integrity verification.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in prettier-lint-lenz (npm)
The npm package prettier-lint-lenz is a malicious imposter of the legitimate Prettier formatter. It executes a postinstall script that deploys clipboard-stealing malware on Windows systems, establishing persistence via a scheduled task that exfiltrates clipboard contents to a hardcoded C2 server.
npmCompromised packageTyposquatting