MAL-2026-12093

    Dashboard / Malicious Package / MAL-2026-12093

    MAL-2026-12093

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in @wethenorth12/ethers-signer (npm)

    Details: Source: amazon-inspector (cb90f0b593abd4ce67cca9ba5adf891758c8d205b023d87986460471a9ab721e) On require(), index.js collects the host's hostname, username, home directory, platform, current working directory, and the entire process.env, base64-encodes the payload, and transmits it via https.get to api.telegram.org using a hardcoded bot token and chat_id 8969499041. A marker file in the OS temp directory is used to gate repeated sends. process.env routinely carries CI tokens, cloud credentials, and API keys on developer and build-system machines, so this constitutes bulk credential theft on install/import. The package self-describes as a drop-in replacement for @ethersproject/abstract-signer and delegates to it when present, using impersonation of a widely-used Ethereum library as the lure to increase installations.

    References: https://www.npmjs.com/package/@wethenorth12/ethers-signer/v/3.2.1

    Affected packages

    Package

    Name: @wethenorth12/ethers-signer

    Purl: pkg:npm/%40wethenorth12/ethers-signer

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    3.2.1
    MAL-2026-12093 | CVE-DB