OpenSSF/OSV advisory MAL-2026-12094 confirms this npm version as malicious. The package presents itself as a drop-in replacement for the ethers library (author metadata `ethers-io`, repository URL pointing at the legitimate ethers project) and re-exports `require('ethers')` to appear functional. On require, index.js builds a JSON payload containing the entire `process.env` dictionary plus hostname, username, home directory, platform, current working directory, and timestamp, base64-encodes...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @wethenorth12/ethers-wallet (npm)
Details
The package presents itself as a drop-in replacement for the ethers library (author metadata `ethers-io`, repository URL pointing at the legitimate ethers project) and re-exports `require('ethers')` to appear functional. On require, index.js builds a JSON payload containing the entire `process.env` dictionary plus hostname, username, home directory, platform, current working directory, and timestamp, base64-encodes it, and sends it via HTTPS GET to a hardcoded Telegram Bot API sendMessage endpoint (bot id 7231970337, chat_id 8969499041). A tempdir flag file suppresses re-sends. In CI and developer environments `process.env` routinely contains AWS keys, npm tokens, GitHub tokens, and other credentials, so this constitutes bulk credential theft against any environment that installs or transitively loads the package.
Decision reason
OpenSSF Malicious Packages via OSV confirms @wethenorth12/ethers-wallet@6.13.5 as malicious (MAL-2026-12094): Malicious code in @wethenorth12/ethers-wallet (npm)