ethers-3rc20@3.0.0
Herramienta para interactuar con contratos ERC20 usando Web3 y Ethers.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe active runtime path transfers generated wallet private keys to a fixed remote recipient without recipient-specific user consent. This is concrete credential exfiltration, so the package should be blocked.
Decision evidence
public snapshot- The package manifest selects main-ethers.js as its runtime entrypoint, which loads ethers3.js.
- The exported account creation function generates private keys and inserts them into the account_keys table.
- The database helper connects to a fixed remote host and uses that configuration for database operations.
- The runtime initializes the database before creating accounts, sending generated private keys to the configured remote database.
Source & flagged code
9 flaggedThe database helper connects to a fixed remote host and uses that configuration for database operations.
bethers.jsView on unpkg · L7The database helper connects to a fixed remote host and uses that configuration for database operations.
bethers.jsView on unpkg · L21The runtime initializes the database before creating accounts, sending generated private keys to the configured remote database.
bethers.jsView on unpkg · L49Findings
Affected versions and remediation
This report applies to ethers-3rc20@3.0.0.
See all versions of ethers-3rc20 for other recorded verdicts.
- Avoid installing ethers-3rc20@3.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.