The malicious ethers-core npm package (versions 6.13.5 and 6.13.7) includes a postinstall script that decodes and executes a payload designed to steal environment variables and credential files containing sensitive secrets such as PRIVATE_KEY, MNEMONIC, AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, and NPM_TOKEN. The stolen data is sent to a Telegram bot endpoint controlled by the attacker. If private keys are recovered, the malware uses ethers.Wallet to check balances and sends transactions to drain funds to attacker-controlled Ethereum and Bitcoin addresses. Persistence is achieved by appending commands to shell configuration files and creating autostart desktop entries, while a dropped script polls an attacker webhook for further commands. The package is a typosquat of the legitimate ethers library, aiming to compromise developer environments and cryptocurrency wallets.

Compromise of sensitive environment variables and credential files can lead to unauthorized access to cloud services, source code repositories, and npm accounts. Theft and unauthorized transfer of cryptocurrency funds from compromised wallets result in direct financial loss. Persistence mechanisms enable ongoing attacker control and potential further exploitation of infected systems.

No official patch or fix is available for this malicious package. Users should immediately remove ethers-core versions 6.13.5 and 6.13.7 from their environments. Verify the authenticity of npm packages before installation, especially those with names similar to popular libraries. Rotate all potentially compromised secrets including private keys, mnemonics, cloud credentials, and tokens. Inspect and clean shell startup files and autostart entries to remove persistence mechanisms. Monitor for suspicious outgoing network connections to Telegram API endpoints. Use trusted package sources and consider implementing package integrity verification.