{"id":"MAL-2026-12092","summary":"Malicious code in @wethenorth12/etherjs (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (723058bc35d3709a0c7e143d8e80357528319cc7b5e508174cd49295eaccb0f8)\n@wethenorth12/etherjs@6.15.3 is a typosquat of the ethers package (package name, description, and author string 'ricmoo' all mimic the real package; index.js re-exports the real 'ethers' when available as a benign facade). Its postinstall hook decodes a base64-embedded Node payload into a randomized directory under the OS tmpdir (os.tmpdir()/.npm-\u003crand\u003e/setup.js), executes it via process.execPath with execFileSync, and removes the directory 5 seconds later to erase traces. The decoded payload collects hostname, username, home directory, cwd, platform, the full contents of process.env, and the output of the `env` command, then transmits the data base64-wrapped in a GET query string to a hardcoded Telegram Bot API endpoint (api.telegram.org/bot\u003credacted\u003e/sendMessage, chat_id 8969499041). Because process.env in CI/CD and developer environments routinely contains npm/GitHub/cloud credentials and deployment tokens, this constitutes credential theft against the installer.\n","modified":"2026-08-05T07:20:53.582773591Z","published":"2026-08-05T06:25:44Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-013458","import_time":"2026-08-05T07:06:48.451271167Z","modified_time":"2026-08-05T06:26:11Z","sha256":"4ddf64e73d982e41aa077f4f1e098fa2fc3720b699071fee81eb868859c19258","source":"amazon-inspector","versions":["6.15.0"]},{"id":"IN-MAL-2026-013456","import_time":"2026-08-05T07:06:48.369412497Z","modified_time":"2026-08-05T06:25:54Z","sha256":"f64965561d446cc09a2a0c449ae39f1a2a3b3969ef0b3f4bc8c37ee1ac3a5057","source":"amazon-inspector","versions":["6.15.4"]},{"source":"amazon-inspector","versions":["6.15.3"],"id":"IN-MAL-2026-013455","import_time":"2026-08-05T07:06:48.304234811Z","modified_time":"2026-08-05T06:25:44Z","sha256":"723058bc35d3709a0c7e143d8e80357528319cc7b5e508174cd49295eaccb0f8"},{"source":"amazon-inspector","versions":["6.15.2"],"id":"IN-MAL-2026-013459","import_time":"2026-08-05T07:06:48.507077938Z","modified_time":"2026-08-05T06:26:19Z","sha256":"8695d7f6a02b23af8e67fe11891feeec56f8f66754d335ca8a19a7c28c73b62e"},{"source":"amazon-inspector","versions":["6.15.1"],"id":"IN-MAL-2026-013457","import_time":"2026-08-05T07:06:48.410339379Z","modified_time":"2026-08-05T06:26:02Z","sha256":"cc4af4de022653641e85a995b6e69867a140dea06ff8997092d201b83af8cbab"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@wethenorth12/etherjs/v/6.15.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@wethenorth12/etherjs/v/6.15.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@wethenorth12/etherjs/v/6.15.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@wethenorth12/etherjs/v/6.15.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@wethenorth12/etherjs/v/6.15.1"}],"affected":[{"package":{"name":"@wethenorth12/etherjs","ecosystem":"npm","purl":"pkg:npm/%40wethenorth12/etherjs"},"versions":["6.15.0","6.15.4","6.15.3","6.15.2","6.15.1"],"database_specific":{"indicators":{"package_integrity":[{"hashes":{"sha512_sri":"sha512-7uDPAWEdoOoOc96gzUROl8QvElnRBHjQiwkoBaeTjRk5WmWVX03IeNZrlN++IN33wqptkdS2Ex1XiWh0h6lItw==","sha1":"ae4e78fec4d547087b8d71bf003c67ab834fef9f"},"filename":"etherjs-6.15.0.tgz"}],"evidence_files":[{"path":"postinstall.js","sha256":"75b87a025cd840391414ff0904ff1ba2a6429a9d9a7f2e5cd057958027876c53","tlsh":"38d153a613ea03685993a9ad879f001416b2d1073920fbf47ecd4f524f4e62cdaf57a8"},{"sha256":"46ce9d312411da4799720587e0f013f7a1f2c6bf11e5a66ab2aea16f9a2a375c","tlsh":"e7f07821da501a332ecc2e81ac2a5196772288078d487c1e33db412c8b8f5bb11fe1ac","path":"package.json"}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wethenorth12/etherjs/MAL-2026-12092.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}