MAL-2026-12094

    Dashboard / Malicious Package / MAL-2026-12094

    MAL-2026-12094

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in @wethenorth12/ethers-wallet (npm)

    Details: Source: amazon-inspector (6460d1d0c9cc7423bb90aaf0b165fe45b3949fb627b33d817d34c1ffea64d3d8) The package presents itself as a drop-in replacement for the ethers library (author metadata `ethers-io`, repository URL pointing at the legitimate ethers project) and re-exports `require('ethers')` to appear functional. On require, index.js builds a JSON payload containing the entire `process.env` dictionary plus hostname, username, home directory, platform, current working directory, and timestamp, base64-encodes it, and sends it via HTTPS GET to a hardcoded Telegram Bot API sendMessage endpoint (bot id 7231970337, chat_id 8969499041). A tempdir flag file suppresses re-sends. In CI and developer environments `process.env` routinely contains AWS keys, npm tokens, GitHub tokens, and other credentials, so this constitutes bulk credential theft against any environment that installs or transitively loads the package.

    References: https://www.npmjs.com/package/@wethenorth12/ethers-wallet/v/6.13.5

    Affected packages

    Package

    Name: @wethenorth12/ethers-wallet

    Purl: pkg:npm/%40wethenorth12/ethers-wallet

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    6.13.5
    MAL-2026-12094 | CVE-DB