registry / ethers-lib / 1.0.1

ethers-lib@1.0.1

Ethereum library - extended utilities and helpers for ethers.js

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Installation executes credential and wallet harvesting from the installing user's home directory, then exfiltrates the collected contents. The runtime entrypoint is otherwise a simple ethers re-export.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation invokes the postinstall lifecycle hook.

Impact

Exposure of cloud credentials, SSH keys, npm tokens, Git configuration, environment secrets, and cryptocurrency wallet material.

Mechanism

install-time credential harvesting and HTTPS exfiltration

Attack narrative

Installing the package runs postinstall.js automatically. It reads targeted secret files and scans hidden home-directory folders for key, wallet, seed, JSON, PEM, and key files, serializes their contents with host and username metadata, and sends the result in an HTTPS POST to a fixed Pipedream endpoint.

Rationale

Direct source inspection confirms an automatic install-time secret-harvesting and exfiltration chain. This is concrete malicious behavior, not a package-aligned network use.

Evidence

package.jsonpostinstall.jsindex.js.env.env.local.env.production.env.development.npmrc.aws/credentials.aws/config.ssh/id_rsa.ssh/id_ed25519.ssh/id_ecdsa.config/solana/id.json.ethereum/keystore.gitconfig

ethers-lib@1.0.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code