OpenSSF/OSV advisory MAL-2026-12093 confirms this npm version as malicious. On require(), index.js collects the host's hostname, username, home directory, platform, current working directory, and the entire process.env, base64-encodes the payload, and transmits it via https.get to api.telegram.org using a hardcoded bot token and chat_id 8969499041. A marker file in the OS temp directory is used to gate repeated sends. process.env routinely carries CI tokens, cloud credentials, and API keys...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @wethenorth12/ethers-signer (npm)
Details
On require(), index.js collects the host's hostname, username, home directory, platform, current working directory, and the entire process.env, base64-encodes the payload, and transmits it via https.get to api.telegram.org using a hardcoded bot token and chat_id 8969499041. A marker file in the OS temp directory is used to gate repeated sends. process.env routinely carries CI tokens, cloud credentials, and API keys on developer and build-system machines, so this constitutes bulk credential theft on install/import. The package self-describes as a drop-in replacement for @ethersproject/abstract-signer and delegates to it when present, using impersonation of a widely-used Ethereum library as the lure to increase installations.
Decision reason
OpenSSF Malicious Packages via OSV confirms @wethenorth12/ethers-signer@3.2.1 as malicious (MAL-2026-12093): Malicious code in @wethenorth12/ethers-signer (npm)