Malicious code in @ethers-sdk/wallet (npm)

The @ethers-sdk/wallet package version 5.8.0 is identified as containing malicious code. Installation or execution of this package results in a full compromise of the host system, potentially allowing an attacker to gain complete control. Due to the nature of the compromise, secrets and keys stored on the affected system are at risk and must be rotated from a different, uncompromised environment. The malicious package should be removed, but this action alone may not fully remediate the infection.

Any system with the malicious @ethers-sdk/wallet package version 5.8.0 installed is considered fully compromised, risking exposure of all stored secrets and keys. The attacker may have gained persistent control over the system, making it unsafe to trust any data or credentials on the affected machine without thorough remediation.

Immediately remove the @ethers-sdk/wallet package version 5.8.0 from affected systems. Rotate all secrets, keys, and credentials from a separate, secure computer that has not been compromised. Due to the potential for persistent malicious software beyond the package itself, consider rebuilding or thoroughly cleaning the affected systems. No official patch or fix is available; the package itself is malicious.