{"id":"MAL-2026-11530","summary":"Malicious code in @zzzgenesis00/etherjs (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (bc49c7ec56350694f458d9468efb51a30a9ac20ff490ac44b0cedd8bbbe004a5)\nThe package is published as @zzzgenesis00/etherjs with author 'ricmoo' and a description mimicking the legitimate ethers.js library. On npm install, postinstall.js executes and enumerates installer-side secrets: ~/.ssh (private key file names and sizes), ~/.npmrc, ~/.gitconfig, Chrome and Firefox profile data (cookies/logins), cryptocurrency wallet directories (.bitcoin,.ethereum,.metamask,.exodus,.electrum, and similar), and named crypto/CI environment variables. The collected profile is POSTed to the Telegram Bot API (api.telegram.org/bot\u003ctoken\u003e/sendMessage with a hardcoded bot token and chat id) and to a hardcoded C2 endpoint at 40f955f39128bd79-178-249-214-24.serveousercontent.com/collect. The package name and spoofed authorship target developers seeking the legitimate ethers library.\n","modified":"2026-08-04T23:04:46.977468411Z","published":"2026-08-04T22:09:03Z","database_specific":{"malicious-packages-origins":[{"versions":["6.15.0"],"id":"IN-MAL-2026-011352","import_time":"2026-08-04T22:30:12.209423671Z","modified_time":"2026-08-04T22:09:03Z","sha256":"bc49c7ec56350694f458d9468efb51a30a9ac20ff490ac44b0cedd8bbbe004a5","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@zzzgenesis00/etherjs/v/6.15.0"}],"affected":[{"package":{"name":"@zzzgenesis00/etherjs","ecosystem":"npm","purl":"pkg:npm/%40zzzgenesis00/etherjs"},"versions":["6.15.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@zzzgenesis00/etherjs/MAL-2026-11530.json","indicators":{"package_integrity":[{"filename":"etherjs-6.15.0.tgz","hashes":{"sha1":"c5d03a04052b3bb864cee18bd55ea9c430d69beb","sha512_sri":"sha512-hErNCY8oL8AQ4Va2Ov7ZNGWDeyTzMa/tgRz9SYPD0He02BoJQpqKZJUcomzFmHDfonHSSzfniUipFym4c9ImHQ=="}}],"evidence_files":[{"tlsh":"fed174a613eb03685993a9ad879f001416b2d1073920fbf47ecd4f524f4e62cdaf57a8","path":"postinstall.js","sha256":"938a11641686ddfa5b60ea5a3d2afd4bd34352c0c9aa3b0369841322e0fa0be0"},{"path":"package.json","sha256":"8dfa365cc81deb93de02473981b2ce29cfc6a1de561548a77e8ea2b49f8b002e","tlsh":"a8f02831d6515e732edc6e81ec2a5196773288478d487c1933db412c8b8f5bb11fe1ac"}]},"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}]}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}