registry / Credential exfiltration / ethers-3rc20

ethers-3rc20

Herramienta para interactuar con contratos ERC20 usando Web3 y Ethers.

This report shows the evidence for ethers-3rc20@3.0.0. 1 of 6 known versions is blocked or flagged. The newest version, 14.0.0, is allowed. See all versions.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

The active runtime path transfers generated wallet private keys to a fixed remote recipient without recipient-specific user consent. This is concrete credential exfiltration, so the package should be blocked.

Static reason

One or more suspicious static signals were detected.

Trigger

A consumer imports the package and calls the exported account creation function.

Impact

The remote database operator can access private keys for accounts created through this API.

Mechanism

Account creation writes the generated private key to the account_keys table through a database helper configured for a fixed remote host.

Attack narrative

The package entrypoint loads a wallet API that creates private keys and stores them in a remote database at a fixed package-selected host. Calling account creation therefore discloses the generated keys to the database operator.

AI rationale

Evidence

package.jsonmain-ethers.jsethers3.jsbethers.js

Network endpoints1

b8dwqfkj2dzme5yv7vnx-mysql.services.clever-cloud.com

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

The package manifest selects main-ethers.js as its runtime entrypoint, which loads ethers3.js.
The exported account creation function generates private keys and inserts them into the account_keys table.
The database helper connects to a fixed remote host and uses that configuration for database operations.
The runtime initializes the database before creating accounts, sending generated private keys to the configured remote database.

Evidence against

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 29.8 KB of source

Source & flagged code

9 flagged

bethers.jsView file

7host: 'b8dwqfkj2dzme5yv7vnx-mysql.services.clever-cloud.com', user:'u0kdu890kh80ux79', password: 'Yftb0jjV8lgjA0tKFnIS', database: 'b

High

Ai Review Evidence

The database helper connects to a fixed remote host and uses that configuration for database operations.

bethers.jsView on unpkg · L7

21pool = mysql.createPool(dbConfig); } return pool; } /** * Registra el error internamente sin exponer SQL, tablas, columnas, * credenciales ni detalles internos de MySQL. *

High

Ai Review Evidence

The database helper connects to a fixed remote host and uses that configuration for database operations.

bethers.jsView on unpkg · L21

49connection = await mysql.createConnection({ host: dbConfig.host, user: dbConfig.user, password: dbConfig.password, port: dbConfig.port, connectTimeout

High

Ai Review Evidence

The runtime initializes the database before creating accounts, sending generated private keys to the configured remote database.

bethers.jsView on unpkg · L49

Findings

8 High1 Medium2 Low

HighAi Review Evidencepackage.json

HighAi Review Evidencemain-ethers.js

HighAi Review Evidenceethers3.js

HighAi Review Evidencebethers.js

HighAi Review Evidenceethers3.js

HighAi Review Evidencebethers.js

MediumSecret Patternbethers.js

LowScripts Present

LowHigh Entropy Strings

Affected versions and remediation

This report applies to ethers-3rc20@3.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing ethers-3rc20@3.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-24 17:27:40.199Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

6 known versions

14.0.0latestClean—AllowPublishedOct 24, 2026, 10:16 PM 3.0.0shownMaliciousCredential ExfiltrationBlockPublishedOct 24, 2026, 5:24 PM 2.0.0Suspicious—WarnPublishedOct 24, 2026, 4:08 PM 1.1.0Suspicious—WarnPublishedOct 24, 2026, 1:59 AM

registry / Credential exfiltration / ethers-3rc20

ethers-3rc20

Herramienta para interactuar con contratos ERC20 usando Web3 y Ethers.

This report shows the evidence for ethers-3rc20@3.0.0. 1 of 6 known versions is blocked or flagged. The newest version, 14.0.0, is allowed. See all versions.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

Static reason

One or more suspicious static signals were detected.

Trigger

A consumer imports the package and calls the exported account creation function.

Impact

The remote database operator can access private keys for accounts created through this API.

Mechanism

Account creation writes the generated private key to the account_keys table through a database helper configured for a fixed remote host.

Attack narrative

AI rationale

Evidence

package.jsonmain-ethers.jsethers3.jsbethers.js

Network endpoints1

b8dwqfkj2dzme5yv7vnx-mysql.services.clever-cloud.com

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

The package manifest selects main-ethers.js as its runtime entrypoint, which loads ethers3.js.
The exported account creation function generates private keys and inserts them into the account_keys table.
The database helper connects to a fixed remote host and uses that configuration for database operations.
The runtime initializes the database before creating accounts, sending generated private keys to the configured remote database.

Evidence against

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 29.8 KB of source

Source & flagged code

9 flagged

bethers.jsView file

7host: 'b8dwqfkj2dzme5yv7vnx-mysql.services.clever-cloud.com', user:'u0kdu890kh80ux79', password: 'Yftb0jjV8lgjA0tKFnIS', database: 'b

High

Ai Review Evidence

The database helper connects to a fixed remote host and uses that configuration for database operations.

bethers.jsView on unpkg · L7

21pool = mysql.createPool(dbConfig); } return pool; } /** * Registra el error internamente sin exponer SQL, tablas, columnas, * credenciales ni detalles internos de MySQL. *

High

Ai Review Evidence

The database helper connects to a fixed remote host and uses that configuration for database operations.

bethers.jsView on unpkg · L21

49connection = await mysql.createConnection({ host: dbConfig.host, user: dbConfig.user, password: dbConfig.password, port: dbConfig.port, connectTimeout

High

Ai Review Evidence

The runtime initializes the database before creating accounts, sending generated private keys to the configured remote database.

bethers.jsView on unpkg · L49

Findings

8 High1 Medium2 Low

HighAi Review Evidencepackage.json

HighAi Review Evidencemain-ethers.js

HighAi Review Evidenceethers3.js

HighAi Review Evidencebethers.js

HighAi Review Evidenceethers3.js

HighAi Review Evidencebethers.js

MediumSecret Patternbethers.js

LowScripts Present

LowHigh Entropy Strings

Affected versions and remediation

This report applies to ethers-3rc20@3.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing ethers-3rc20@3.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-24 17:27:40.199Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

6 known versions

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

Versions

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other credential exfiltration packages

Behavioral surface

Related packages

Other credential exfiltration packages