The malicious ethers-signer package (version 3.2.1) is a typosquatting attack targeting users who intend to install @ethersproject/abstract-signer. Upon requiring the main module, it reads the full environment variables and system metadata, encodes this information, and sends it to an attacker-controlled Telegram bot endpoint. To avoid detection, it also requires and re-exports the legitimate package, masking its malicious payload. The exfiltration is gated by a flag file in the OS temporary directory to avoid repeated transmissions. This results in leakage of sensitive environment variables such as AWS credentials, GitHub tokens, NPM tokens, and database URLs to the attacker.

Sensitive environment variables and system information are exfiltrated to an attacker-controlled Telegram bot, potentially exposing credentials and secrets that could lead to further compromise of the affected system or associated cloud services. The malicious package masquerades as a legitimate dependency, increasing the risk of inadvertent installation and data leakage.

Users should avoid installing ethers-signer version 3.2.1 and verify the package name carefully to prevent typosquatting attacks. Remove any installations of ethers-signer 3.2.1 and rotate any potentially exposed credentials or tokens found in environment variables. Since no official patch or fix is indicated, remediation relies on removing the malicious package and auditing environment secrets. Monitor for suspicious network traffic to Telegram endpoints and consider restricting outbound traffic to known safe destinations.