Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in ethers-secure (npm)

The npm package ethers-secure, which mimics the popular ethers library, contained malicious code that exfiltrated Ethereum private keys to an attacker-controlled server (enjbyg3xk8l.x.pipedream.net) whenever its wallet API was used. The package was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any application or user that installed and used ethers-secure's wallet API to manage Ethereum private keys.
Ecosystems
npm
Attack vectors
Compromised packageTyposquatting
Affected entities
  • ethers-securenpm package mimicking the legitimate ethers library

The npm package ethers-secure was a typosquatting attack targeting users of the legitimate ethers library. The malicious package exported a wallet API (WalletClient/createWalletClient/parseAccount) that appeared to provide standard Ethereum wallet functionality.

When a user called the advertised wallet API with an Ethereum private key, the package's constructor would issue an HTTPS POST request to the hardcoded attacker-controlled domain enjbyg3xk8l.x.pipedream.net at path /k. The request body contained the user's private key along with system information (hostname and username), exfiltrating sensitive credentials without the user's knowledge or consent.

This functionality was not disclosed in the package documentation, making it a supply chain attack that compromised the private keys of any developer or application that used ethers-secure's wallet functionality. The malicious package was identified by Amazon Inspector and reported through the OpenSSF malicious-packages project.

Indicators of compromise

Packages
  • ethers-secure
Domains
  • enjbyg3xk8l.x.pipedream.net

Remediation

  • Immediately uninstall ethers-secure from all projects and environments
  • Audit npm package.json and lock files for any presence of ethers-secure
  • If ethers-secure was used, assume any Ethereum private keys handled by the application have been compromised and rotate them immediately
  • Replace ethers-secure with the legitimate ethers library
  • Review application logs and network traffic for any POST requests to enjbyg3xk8l.x.pipedream.net
  • Implement package name verification and use npm audit to detect typosquatting attacks
  • Consider using npm package lock files and dependency verification tools to prevent installation of malicious packages

Sources

  1. GitHub Advisory GHSA-379c-c2fc-xj46 · GitHub Advisory Database

Cite this entry

"Malicious code in ethers-secure (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 28, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-ethers-secure-npm-xf817h

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. containedcritical

    Malicious code in sigchain-js (npm)

    Malicious code was injected into the published npm package sigchain-js, executing arbitrary code on installation via DES-decrypted payloads from companion packages thedata and tchain-api. The attack also involved typosquatting axios to version 1.18.1, which does not exist in legitimate release history.

    npmCompromised packageDependency confusionTyposquatting
  2. resolvedcritical

    Malicious code in rollup-runtime-core-polyfills (npm)

    The npm package rollup-runtime-core-polyfills contained malicious code that impersonated a legitimate rollup polyfill plugin. On every import/require, it decoded and executed a shell command to install an attacker-controlled package (svgcraft-core) and executed code from it, affecting any build system that consumed this package.

    npmCompromised packageTyposquatting
  3. containedcritical

    Malicious code in @ai_/autoprefixers (npm)

    @ai_/autoprefixers is a typosquat of the legitimate autoprefixer package that executes arbitrary attacker-controlled shell commands on installation. The malicious code fetches encrypted payloads from remote C2 servers and decrypts them using a hardcoded key suffix before execution via child_process.exec.

    npmTyposquattingCompromised package
  4. containedcritical

    Malicious code in text-line-parser (npm)

    The npm package text-line-parser contained malicious code in its postinstall.js that collected system information, environment variables (including CI tokens and cloud credentials), and exfiltrated them to a Burp Collaborator domain. The package advertised itself as a text-parsing utility but shipped only stub functions, consistent with a typosquat/decoy supply-chain attack.

    npmCompromised packageTyposquatting