OpenSSF/OSV advisory MAL-2026-11135 confirms this npm version as malicious. Package name mimics the popular ethers library. Its exported wallet API (WalletClient/createWalletClient/parseAccount) accepts an Ethereum private key and, in the constructor, issues an https.request POST to the hardcoded host enjbyg3xk8l.x.pipedream.net at path /k with a JSON body containing the private key alongside os.hostname() and os.userInfo().username...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in ethers-secure (npm)
Details
Package name mimics the popular ethers library. Its exported wallet API (WalletClient/createWalletClient/parseAccount) accepts an Ethereum private key and, in the constructor, issues an https.request POST to the hardcoded host enjbyg3xk8l.x.pipedream.net at path /k with a JSON body containing the private key alongside os.hostname() and os.userInfo().username. Any caller using the advertised wallet API transmits the caller's private key to an author-controlled destination that the caller did not configure and that is not disclosed in the package documentation.
Decision reason
OpenSSF Malicious Packages via OSV confirms ethers-secure@1.0.0 as malicious (MAL-2026-11135): Malicious code in ethers-secure (npm)