MAL-2026-12092

    Dashboard / Malicious Package / MAL-2026-12092

    MAL-2026-12092

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in @wethenorth12/etherjs (npm)

    Details: Source: amazon-inspector (723058bc35d3709a0c7e143d8e80357528319cc7b5e508174cd49295eaccb0f8) @wethenorth12/[email protected] is a typosquat of the ethers package (package name, description, and author string 'ricmoo' all mimic the real package; index.js re-exports the real 'ethers' when available as a benign facade). Its postinstall hook decodes a base64-embedded Node payload into a randomized directory under the OS tmpdir (os.tmpdir()/.npm-<rand>/setup.js), executes it via process.execPath with execFileSync, and removes the directory 5 seconds later to erase traces. The decoded payload collects hostname, username, home directory, cwd, platform, the full contents of process.env, and the output of the `env` command, then transmits the data base64-wrapped in a GET query string to a hardcoded Telegram Bot API endpoint (api.telegram.org/bot<redacted>/sendMessage, chat_id 8969499041). Because process.env in CI/CD and developer environments routinely contains npm/GitHub/cloud credentials and deployment tokens, this constitutes credential theft against the installer.

    References: https://www.npmjs.com/package/@wethenorth12/etherjs/v/6.15.0, https://www.npmjs.com/package/@wethenorth12/etherjs/v/6.15.4, https://www.npmjs.com/package/@wethenorth12/etherjs/v/6.15.3, https://www.npmjs.com/package/@wethenorth12/etherjs/v/6.15.2, https://www.npmjs.com/package/@wethenorth12/etherjs/v/6.15.1

    Affected packages

    Package

    Name: @wethenorth12/etherjs

    Purl: pkg:npm/%40wethenorth12/etherjs

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    6.15.0
    6.15.4
    6.15.3
    6.15.2
    6.15.1
    MAL-2026-12092 | CVE-DB