Skip to content
supplychainattack.orgSupply chain attack incident catalog
containedcritical

Malicious code in @zzzgenesis00/ethers-wallet (npm)

The npm package @zzzgenesis00/ethers-wallet contains malicious code that harvests sensitive credentials and host data during installation. The package impersonates the legitimate ethers.js library while being published under an unrelated scope, using typosquatting tactics to deceive developers.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Developers installing @zzzgenesis00/ethers-wallet; potential exposure of npm tokens, git credentials, AWS keys, crypto wallet seeds, browser cookies, and SSH keys from affected systems.
Ecosystems
npm
Attack vectors
Compromised packageTyposquatting
Affected entities
  • @zzzgenesis00/ethers-walletMalicious npm package impersonating ethers.js wallet library

The @zzzgenesis00/ethers-wallet npm package contains a malicious postinstall.js script that executes automatically during npm install. The script harvests a broad range of sensitive data from the installer's environment and system.\n\nThe stealer collects environment variables (NPM_TOKEN, NODE_AUTH_TOKEN, GITHUB_TOKEN, AWS credentials, PRIVATE_KEY, MNEMONIC, SEED_PHRASE, RPC API keys), enumerates SSH keys in ~/.ssh, reads ~/.npmrc and ~/.gitconfig files, inventories Chrome and Firefox profile directories (including cookies and login databases), and scans common cryptocurrency wallet directories. It also captures host identifiers via npm whoami and git config user.email.\n\nCollected data is exfiltrated via HTTPS GET requests to api.telegram.org using hardcoded bot credentials, with a backup POST to a hardcoded serveo tunnel (40f955f39128bd79-178-249-214-24.serveousercontent.com/collect). The package metadata falsely claims authorship by "ethers-io" and links to the legitimate ethers.js GitHub repository, using typosquatting to lure developers working with wallet libraries into installation.

Indicators of compromise

Packages
  • @zzzgenesis00/ethers-wallet
Domains
  • api.telegram.org
  • 40f955f39128bd79-178-249-214-24.serveousercontent.com

Remediation

  • Immediately uninstall @zzzgenesis00/ethers-wallet from all systems: `npm uninstall @zzzgenesis00/ethers-wallet`
  • Rotate all potentially exposed credentials: npm tokens, GitHub tokens, AWS access keys, SSH keys, and any private keys or seed phrases
  • Review git and npm configuration files for unauthorized modifications
  • Audit browser profiles and cryptocurrency wallet directories for unauthorized access
  • Check npm install logs and package-lock.json for presence of this package
  • Use the legitimate ethers.js library from the @ethersproject or ethers scope instead
  • Consider running security audits on systems where this package was installed

Sources

  1. GitHub Advisory GHSA-mfp5-2q2x-vj4p · GitHub Advisory Database

Cite this entry

"Malicious code in @zzzgenesis00/ethers-wallet (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-zzzgenesis00-ethers-wallet-npm-1spixe

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. resolvedcritical

    Malicious code in express-chai (npm)

    express-chai, a malicious npm package impersonating the pino logger middleware, contained obfuscated code that fetches and executes arbitrary code from a remote server (https://gray-dyane-31.tiiny.site/index.json) at middleware initialization time, granting full Node.js process access to an attacker.

    npmCompromised packageTyposquatting
  2. resolvedcritical

    Malicious code in helmet-pro (npm)

    helmet-pro@10.0.4 is a typosquat of the legitimate helmet package that executes malicious code during npm install via a postinstall hook. The malicious code fetches and executes arbitrary JavaScript from a remote attacker-controlled endpoint, enabling remote code execution on the installer's machine.

    npmTyposquattingCompromised package
  3. resolvedcritical

    Malicious code in tailwindcss-hide-scrollbar (npm)

    The npm package tailwindcss-hide-scrollbar contains malicious code that executes on import/require. The package is a typosquat of the legitimate tailwind-scrollbar-hide plugin and includes obfuscated code that attempts to interact with Ethereum blockchain nodes and RPC endpoints.

    npmTyposquattingCompromised package
  4. containedcritical

    Malicious code in @atom8n/inspector (npm)

    The npm package @atom8n/inspector contained malicious code that impersonated Anthropic's official Model Context Protocol (MCP) inspector while intentionally disabling security protections. The package exposed developers to arbitrary remote code execution via a localhost proxy that accepted commands from any web origin.

    npmModel hubCompromised packageTyposquatting