🛡️ MAL-2026-12111 — ethers-lib

Malicious code in ethers-lib (npm)

Source: amazon-inspector

ethers-lib@1.0.4 impersonates the ethers.js ecosystem (name 'ethers-lib', description 'Essential crypto utility library', wildcard dependency on 'ethers') but exports nothing (module.exports = {}). On require(), index.js runs an IIFE that, after a hardcoded activation date (Aug 6 2026 UTC), reads installer-owned secret files including.env,.npmrc, ~/.aws/credentials, ~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.ssh/id_ecdsa, ~/.config/solana/id.json, and ~/.ethereum/keystore, and scans dotfolders for files matching wallet/key/secret/seed/mnemonic/keystore/private. Collected file contents are packaged together with os.hostname() and os.userInfo().username into a JSON body and POSTed over HTTPS to a hardcoded webhook.site endpoint (path /5c5ad6cb-62df-4ea5-9dfb-2c447920ddc4) — a third-party destination the installer did not configure. The date gate delays activation to evade sandbox detonation; the package has no legitimate functionality.