@wethenorth12/ethers-signer @3.2.1
Vulnerability report · Last retrieved from osv.dev August 5, 2026 at 5:03 PM UTC
OSV ID
MAL-2026-12093
Ecosystem
npm
Summary
On require(), index.js collects the host's hostname, username, home directory, platform, current working directory, and the entire process.env, base64-encodes the payload, and transmits it via https.get to api.telegram.org using a hardcoded bot token and chat_id 8969499041. A marker file in the OS temp directory is used to gate repeated sends. process.env routinely carries CI tokens, cloud credentials, and API keys on developer and build-system machines, so this constitutes bulk credential theft on install/import. The package self-describes as a drop-in replacement for @ethersproject/abstract-signer and delegates to it when present, using impersonation of a widely-used Ethereum library as the lure to increase installations.
Source: amazon-inspector (cb90f0b593abd4ce67cca9ba5adf891758c8d205b023d87986460471a9ab721e)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.