Malicious code in ethers-io-ethers (npm)

The ethers-io-ethers npm package version 6.15.0 has been identified as containing malicious code. Installation or execution of this package results in a full compromise of the affected system, potentially allowing an attacker to gain complete control. Due to the nature of the compromise, simply uninstalling the package may not remove all malicious artifacts. The advisory recommends immediate rotation of all secrets and keys from a secure environment to mitigate ongoing risk.

Systems with ethers-io-ethers version 6.15.0 installed or running are fully compromised, potentially exposing all stored secrets and keys. Attackers may have persistent control beyond the presence of the malicious package itself, increasing the risk of data theft and further system manipulation.

Remove the ethers-io-ethers package version 6.15.0 immediately. Rotate all secrets and keys from a different, uncompromised computer to prevent unauthorized access. Because full system compromise is possible, consider a comprehensive system integrity check and remediation beyond package removal.