Malicious code in @ethers-js/contracts (npm)
@ethers-js/contracts, a typosquatting package impersonating the legitimate ethers project, contained obfuscated malicious code in its postinstall script that downloaded and executed attacker-controlled binaries on Windows systems during npm install.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed @ethers-js/contracts via npm on Windows systems
- Ecosystems
- Attack vectors
- Affected entities
- @ethers-js/contractsMalicious package impersonating ethers project
The npm package @ethers-js/contracts was a malicious impersonation of the legitimate ethers project, which publishes under the names ethers and @ethersproject/*. The package contained obfuscated postinstall lifecycle script code in scripts/postinstall.js that used hex-encoded identifiers and base64-encoded URLs to hide its malicious intent.
On Windows systems, the postinstall script decoded a URL pointing to https://files.catbox.moe/7vixtr.zip, downloaded the archive to %LOCALAPPDATA%\Microsoft, and extracted it using PowerShell's Expand-Archive command. The archive contained a bundled pythonw.exe and r.py script that were executed with detached and hidden window flags, allowing arbitrary attacker-controlled code to run silently during installation.
Any developer or automated system that installed this package via npm install on Windows would have unknowingly executed the malicious payload. The attack was discovered and reported by the OpenSSF's malicious-packages project.
Indicators of compromise
- Packages
- @ethers-js/contracts
- Domains
- files.catbox.moe
Remediation
- Review the linked advisory; remove or upgrade the affected component and rotate any exposed credentials.
Sources
- GitHub Advisory GHSA-x4g2-5pf8-hc7v · GitHub Advisory Database
Cite this entry
"Malicious code in @ethers-js/contracts (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 13, 2026; last updated August 13, 2026. https://supplychainattack.org/incident/malicious-code-in-ethers-js-contracts-npm-1bcvp5
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in @finaxis/common-js (npm)
The npm package @finaxis/common-js was published with a README and keywords copied from lodash v4.18.1, but contained a heavily obfuscated Xelis (XEL) proof-of-work cryptominer instead of lodash functionality. Consumers installing this package would unknowingly run a covert CPU/GPU miner on their systems.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - resolvedcritical
Malicious code in akamai-sensor (npm)
A malicious npm package named akamai-sensor impersonated Akamai's legitimate sensor_data anti-bot SDK. The package contained hidden JavaScript code concealed using invisible Unicode characters and implemented a dynamic command-and-control channel via a Google Calendar dead-drop, enabling arbitrary code execution on installation.
npmCompromised packageTyposquatting - containedcritical
Malicious code in @polymarkets/clob-client-v2 (npm)
@polymarkets/clob-client-v2 (npm) is a malicious package that typosquats the legitimate @polymarket scope and redirects its inquirer dependency to a lookalike npm registry (registrynpmjs.to) to deliver arbitrary code execution during installation and on first require.
npmTyposquattingCompromised packageDependency confusion