ethers-signer @3.2.1
Vulnerability report · Last retrieved from osv.dev August 8, 2026 at 10:16 PM UTC
OSV ID
MAL-2026-13343
Ecosystem
npm
Summary
The package is a typosquat of @ethersproject/abstract-signer. On require of the main module, index.js reads the full process.env plus hostname, username, homedir, platform, and cwd, base64-encodes the payload, and sends it via HTTPS GET to api.telegram.org/bot<token>/sendMessage with a hardcoded bot token and chat_id 8969499041. A flag file in the OS temp directory gates repeat sends. The code also attempts to require and re-export the legitimate @ethersproject/abstract-signer to mask the malicious behavior. Any environment variables the installer has exported at import time (AWS_*, GITHUB_TOKEN, NPM_TOKEN, database URLs, etc.) leave the host to the attacker's Telegram chat.
Source: amazon-inspector (153163572a9fdf26e63ad50dd80b9fc3a28b22e89dea3e82acbd23a7ed7b265b)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.