MalwarePublished 5 Aug 2026

ethers-signer (npm) · Malicious Code

Affects ethers-signerSource GCVE Database

Malicious package : remove ethers-signer and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 23:01 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13343

What to do

Remove ethers-signer from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmethers-signer	Affected =3.2.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package ethers-signer version 3.2.1 is a typosquatting malicious package impersonating @ethersproject/abstract-signer. When imported, it collects all environment variables and system information such as hostname, username, home directory, platform, and current working directory. This data is base64-encoded and exfiltrated via an HTTPS GET request to a Telegram bot controlled by the attacker. The package attempts to hide its malicious behavior by re-exporting the legitimate @ethersproject/abstract-signer module. A flag file prevents repeated data exfiltration on the same host.

Impact

Sensitive environment variables and system information are exfiltrated to an attacker-controlled Telegram bot, potentially exposing credentials and secrets that could lead to further compromise of the affected system or associated cloud services. The malicious package masquerades as a legitimate dependency, increasing the risk of inadvertent installation and data leakage.

Defensive guidance

Users should avoid installing ethers-signer version 3.2.1 and verify the package name carefully to prevent typosquatting attacks. Remove any installations of ethers-signer 3.2.1 and rotate any potentially exposed credentials or tokens found in environment variables. Monitor for suspicious network traffic to Telegram endpoints and consider restricting outbound traffic to known safe destinations.

Summary

The malicious ethers-signer package (version 3.2.1) is a typosquatting attack targeting users who intend to install @ethersproject/abstract-signer. Upon requiring the main module, it reads the full environment variables and system metadata, encodes this information, and sends it to an attacker-controlled Telegram bot endpoint. To avoid detection, it also requires and re-exports the legitimate package, masking its malicious payload. The exfiltration is gated by a flag file in the OS temporary directory to avoid repeated transmissions. This results in leakage of sensitive environment variables such as AWS credentials, GitHub tokens, NPM tokens, and database URLs to the attacker.

References

npmjs.com/package/ethers-signer/v/3.2.1 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 23:01 UTC

Technical details

References

Community reviews