@ethers-js/contracts @6.9.0

Summary

Package impersonates the ethers project (real releases publish under ethers and @ethersproject/* , not @ethers-js ). The postinstall lifecycle script in scripts/postinstall.js is obfuscated with \x-hex-encoded identifiers (require('fs'), require('https'), spawn('powershell',...)) and a base64-encoded download URL. On Windows, it decodes the URL to https://files.catbox.moe/7vixtr.zip, downloads the archive into %LOCALAPPDATA%\Microsoft\<random>, extracts it via PowerShell Expand-Archive, and then invokes a bundled pythonw.exe against r.py with {detached:true, windowsHide:true} and.unref(), executing attacker-controlled code hidden from the user on npm install .

Source: amazon-inspector (06aee7d1e943a9d9a705acf4f28286eb5460ab9a56057a0811274787478f7c68)