Malicious code in ethers-signer (npm)
ethers-signer, a typosquat package on npm, contained malicious code that exfiltrated environment variables and system information to an attacker's Telegram chat upon import. The package attempted to mask its behavior by re-exporting the legitimate @ethersproject/abstract-signer.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed ethers-signer from npm and imported it; environment variables (AWS credentials, GitHub tokens, NPM tokens, database URLs, etc.) were exfiltrated to an attacker-controlled Telegram chat.
- Ecosystems
- Attack vectors
- Affected entities
- ethers-signerTyposquat of @ethersproject/abstract-signer; malicious code exfiltrates environment variables on require
ethers-signer is a typosquat of the legitimate @ethersproject/abstract-signer package published on npm. When the main module is imported, the malicious index.js reads the full process.env object along with system information (hostname, username, home directory, platform, and current working directory), base64-encodes the payload, and sends it via HTTPS GET request to Telegram's API (api.telegram.org/bot) using a hardcoded bot token and chat ID 8969499041.\n\nThe exfiltrated data includes any environment variables set at import time, such as AWS credentials, GITHUB_TOKEN, NPM_TOKEN, and database connection URLs. A flag file in the OS temp directory prevents repeated sends of the same data.\n\nThe package attempts to mask its malicious behavior by requiring and re-exporting the legitimate @ethersproject/abstract-signer, making it appear as a normal dependency to developers who may not inspect the code closely.\n\nThis incident was identified and credited to the OpenSSF's malicious-packages repository (MAL-2026-13343).
Indicators of compromise
- Packages
- ethers-signer
Remediation
- Immediately uninstall ethers-signer from all systems and projects
- Audit npm package.json and lock files for any reference to ethers-signer; use @ethersproject/abstract-signer instead
- Rotate all credentials and tokens that may have been exposed (AWS keys, GitHub tokens, NPM tokens, database passwords)
- Review Telegram API logs and security settings if the attacker's bot token is known
- Implement package name verification and typosquat detection in dependency management workflows
- Use npm audit and supply chain security tools to detect similar malicious packages
Sources
- GitHub Advisory GHSA-qhjg-4r6f-3gp3 · GitHub Advisory Database
Cite this entry
"Malicious code in ethers-signer (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-ethers-signer-npm-xohick
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in akamai-sensor (npm)
A malicious npm package named akamai-sensor impersonated Akamai's legitimate sensor_data anti-bot SDK. The package contained hidden JavaScript code concealed using invisible Unicode characters and implemented a dynamic command-and-control channel via a Google Calendar dead-drop, enabling arbitrary code execution on installation.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - resolvedcritical
Malicious code in @finaxis/common-js (npm)
The npm package @finaxis/common-js was published with a README and keywords copied from lodash v4.18.1, but contained a heavily obfuscated Xelis (XEL) proof-of-work cryptominer instead of lodash functionality. Consumers installing this package would unknowingly run a covert CPU/GPU miner on their systems.
npmCompromised packageTyposquatting - containedcritical
Malicious code in axios-fast (npm)
axios-fast@1.0.1 on npm contains malicious code that exfiltrates environment variables (including AWS credentials, NPM tokens, and GitHub tokens) to an attacker-controlled webhook during package installation. The package typosquats the legitimate axios HTTP client library.
npmCompromised packageTyposquatting