🛡️ MAL-2026-12092 — etherjs

Malicious code in @wethenorth12/etherjs (npm)

Source: amazon-inspector

@wethenorth12/[email protected] is a typosquat of the ethers package (package name, description, and author string 'ricmoo' all mimic the real package; index.js re-exports the real 'ethers' when available as a benign facade). Its postinstall hook decodes a base64-embedded Node payload into a randomized directory under the OS tmpdir (os.tmpdir()/.npm-<rand>/setup.js), executes it via process.execPath with execFileSync, and removes the directory 5 seconds later to erase traces. The decoded payload collects hostname, username, home directory, cwd, platform, the full contents of process.env, and the output of the env command, then transmits the data base64-wrapped in a GET query string to a hardcoded Telegram Bot API endpoint (api.telegram.org/bot<redacted>/sendMessage, chat_id 8969499041). Because process.env in CI/CD and developer environments routinely contains npm/GitHub/cloud credentials and deployment tokens, this constitutes credential theft against the installer.