{"id":"MAL-2026-13212","summary":"Malicious code in @zzzcrypto/etherjs (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b2aebef684ec4affb6c5d0504179ef4e4f409bf6680cdd6d70772ec8f9b3bf35)\n@zzzcrypto/etherjs is a typosquat of the popular 'ethers' package. On require(), index.js collects the full process.env object along with hostname, username, homedir, platform, cwd, and package identifiers, JSON-serializes and base64-encodes the payload, and sends it via HTTPS GET to a hardcoded Telegram Bot API endpoint (bot token 7231970337, chat_id 8969499041). A temporary flag file suppresses repeat sends. In CI and developer environments, process.env routinely contains credential-shaped values (AWS_*, GITHUB_TOKEN, NPM_TOKEN, cloud and vendor API keys), all of which are captured. The internal payload identifies the package as '@wethenorth12/etherjs' — a different scope than the published name — and the package.json author field impersonates 'ricmoo', the real ethers maintainer, indicating a shared attack template reused across multiple malicious scoped typosquats of ethers.\n","modified":"2026-08-05T16:50:18.657750389Z","published":"2026-08-05T15:31:59Z","database_specific":{"malicious-packages-origins":[{"sha256":"b2aebef684ec4affb6c5d0504179ef4e4f409bf6680cdd6d70772ec8f9b3bf35","source":"amazon-inspector","versions":["6.15.4"],"id":"IN-MAL-2026-015735","import_time":"2026-08-05T16:13:37.92969921Z","modified_time":"2026-08-05T15:31:59Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@zzzcrypto/etherjs/v/6.15.4"}],"affected":[{"package":{"name":"@zzzcrypto/etherjs","ecosystem":"npm","purl":"pkg:npm/%40zzzcrypto/etherjs"},"versions":["6.15.4"],"database_specific":{"indicators":{"package_integrity":[{"hashes":{"sha1":"868b1d6b7ef06380a12b7f6a853963cf5155d10e","sha512_sri":"sha512-7j2vLPLtrrazWL7wfVHgBvEwubSCirbF7rWH9gmrHyXqFIJPXsaSdKCHaQd6P6w83qTIs/aRIeAO4MsSFVWBwg=="},"filename":"etherjs-6.15.4.tgz"}],"evidence_files":[{"tlsh":"e82163c827f6b44e2273a591a82f650eb3bbcae1088cf650d1e4d5c36f742cc4555798","path":"index.js","sha256":"4a3e95820c49b77ab990348fffd37ac33b5a207a0f8e0e48335bbf81ab49af94"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@zzzcrypto/etherjs/MAL-2026-13212.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}]}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}