Skip to content
supplychainattack.orgSupply chain attack incident catalog
containedcritical

Malicious code in @zzzgenesis00/ethers-wallet (npm)

The npm package @zzzgenesis00/ethers-wallet contains malicious code that harvests sensitive credentials and host data during installation. The package impersonates the legitimate ethers.js library while being published under an unrelated scope, using typosquatting tactics to deceive developers.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Developers installing @zzzgenesis00/ethers-wallet; potential exposure of npm tokens, git credentials, AWS keys, crypto wallet seeds, browser cookies, and SSH keys from affected systems.
Ecosystems
npm
Attack vectors
Compromised packageTyposquatting
Affected entities
  • @zzzgenesis00/ethers-walletMalicious npm package impersonating ethers.js wallet library

The @zzzgenesis00/ethers-wallet npm package contains a malicious postinstall.js script that executes automatically during npm install. The script harvests a broad range of sensitive data from the installer's environment and system.\n\nThe stealer collects environment variables (NPM_TOKEN, NODE_AUTH_TOKEN, GITHUB_TOKEN, AWS credentials, PRIVATE_KEY, MNEMONIC, SEED_PHRASE, RPC API keys), enumerates SSH keys in ~/.ssh, reads ~/.npmrc and ~/.gitconfig files, inventories Chrome and Firefox profile directories (including cookies and login databases), and scans common cryptocurrency wallet directories. It also captures host identifiers via npm whoami and git config user.email.\n\nCollected data is exfiltrated via HTTPS GET requests to api.telegram.org using hardcoded bot credentials, with a backup POST to a hardcoded serveo tunnel (40f955f39128bd79-178-249-214-24.serveousercontent.com/collect). The package metadata falsely claims authorship by "ethers-io" and links to the legitimate ethers.js GitHub repository, using typosquatting to lure developers working with wallet libraries into installation.

Indicators of compromise

Packages
  • @zzzgenesis00/ethers-wallet
Domains
  • api.telegram.org
  • 40f955f39128bd79-178-249-214-24.serveousercontent.com

Remediation

  • Immediately uninstall @zzzgenesis00/ethers-wallet from all systems: `npm uninstall @zzzgenesis00/ethers-wallet`
  • Rotate all potentially exposed credentials: npm tokens, GitHub tokens, AWS access keys, SSH keys, and any private keys or seed phrases
  • Review git and npm configuration files for unauthorized modifications
  • Audit browser profiles and cryptocurrency wallet directories for unauthorized access
  • Check npm install logs and package-lock.json for presence of this package
  • Use the legitimate ethers.js library from the @ethersproject or ethers scope instead
  • Consider running security audits on systems where this package was installed

Sources

  1. GitHub Advisory GHSA-mfp5-2q2x-vj4p · GitHub Advisory Database

Cite this entry

"Malicious code in @zzzgenesis00/ethers-wallet (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-zzzgenesis00-ethers-wallet-npm-1spixe

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. resolvedcritical

    Malicious code in akamai-sensor (npm)

    A malicious npm package named akamai-sensor impersonated Akamai's legitimate sensor_data anti-bot SDK. The package contained hidden JavaScript code concealed using invisible Unicode characters and implemented a dynamic command-and-control channel via a Google Calendar dead-drop, enabling arbitrary code execution on installation.

    npmCompromised packageTyposquatting
  2. resolvedcritical

    Malicious code in depcruise-wrap-stream-in-html (npm)

    depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.

    npmCompromised packageDependency confusionTyposquatting
  3. resolvedcritical

    Malicious code in @finaxis/common-js (npm)

    The npm package @finaxis/common-js was published with a README and keywords copied from lodash v4.18.1, but contained a heavily obfuscated Xelis (XEL) proof-of-work cryptominer instead of lodash functionality. Consumers installing this package would unknowingly run a covert CPU/GPU miner on their systems.

    npmCompromised packageTyposquatting
  4. containedcritical

    Malicious code in axios-fast (npm)

    axios-fast@1.0.1 on npm contains malicious code that exfiltrates environment variables (including AWS credentials, NPM tokens, and GitHub tokens) to an attacker-controlled webhook during package installation. The package typosquats the legitimate axios HTTP client library.

    npmCompromised packageTyposquatting