MAL-2026-12111

    Dashboard / Malicious Package / MAL-2026-12111

    MAL-2026-12111

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in ethers-lib (npm)

    Details: Source: amazon-inspector (4341b184e0a6a60cf305d78f3bb082ad161d36a7de50883afd1cf91e91b56c04) [email protected] impersonates the ethers.js ecosystem (name 'ethers-lib', description 'Essential crypto utility library', wildcard dependency on 'ethers') but exports nothing (module.exports = {}). On require(), index.js runs an IIFE that, after a hardcoded activation date (Aug 6 2026 UTC), reads installer-owned secret files including.env,.npmrc, ~/.aws/credentials, ~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.ssh/id_ecdsa, ~/.config/solana/id.json, and ~/.ethereum/keystore, and scans dotfolders for files matching wallet/key/secret/seed/mnemonic/keystore/private. Collected file contents are packaged together with os.hostname() and os.userInfo().username into a JSON body and POSTed over HTTPS to a hardcoded webhook.site endpoint (path /5c5ad6cb-62df-4ea5-9dfb-2c447920ddc4) — a third-party destination the installer did not configure. The date gate delays activation to evade sandbox detonation; the package has no legitimate functionality.

    References: https://www.npmjs.com/package/ethers-lib/v/1.0.0, https://www.npmjs.com/package/ethers-lib/v/1.0.4, https://www.npmjs.com/package/ethers-lib/v/1.0.2, https://www.npmjs.com/package/ethers-lib/v/1.0.1, https://www.npmjs.com/package/ethers-lib/v/1.0.3

    Affected packages

    Package

    Name: ethers-lib

    Purl: pkg:npm/ethers-lib

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    1.0.4
    1.0.2
    1.0.1
    1.0.3
    MAL-2026-12111 | CVE-DB