MAL-2026-13937

    Dashboard / Malicious Package / MAL-2026-13937

    MAL-2026-13937

    Published: 13 Aug 2026Last Modified: 13 Aug 2026

    Summary: Malicious code in @ethers-js/contracts (npm)

    Details: Source: amazon-inspector (06aee7d1e943a9d9a705acf4f28286eb5460ab9a56057a0811274787478f7c68) Package impersonates the ethers project (real releases publish under `ethers` and `@ethersproject/*`, not `@ethers-js`). The `postinstall` lifecycle script in scripts/postinstall.js is obfuscated with \x-hex-encoded identifiers (require('fs'), require('https'), spawn('powershell',...)) and a base64-encoded download URL. On Windows, it decodes the URL to https://files.catbox.moe/7vixtr.zip, downloads the archive into %LOCALAPPDATA%\Microsoft\<random>, extracts it via PowerShell Expand-Archive, and then invokes a bundled pythonw.exe against r.py with {detached:true, windowsHide:true} and.unref(), executing attacker-controlled code hidden from the user on `npm install`.

    References: https://www.npmjs.com/package/@ethers-js/contracts/v/6.9.0

    Affected packages

    Package

    Name: @ethers-js/contracts

    Purl: pkg:npm/%40ethers-js/contracts

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    6.9.0
    MAL-2026-13937 | CVE-DB