Malicious code in ethers-v6 (npm)

The ethers-v6 package for npm, specifically versions 1.0.0, 9.0.0, and 90.0.0, has been identified as containing malicious code. Installation or execution of these versions results in a full compromise of the host system, allowing an attacker to gain control. Due to the severity of the compromise, all secrets and keys on the affected machine should be rotated immediately from a separate, trusted device. Simply uninstalling the package may not remove all malicious artifacts introduced by it.

Full system compromise on any computer running the affected versions of ethers-v6, leading to potential unauthorized access to all stored secrets and keys. The attacker may maintain persistence beyond removal of the malicious package.

Remove the malicious ethers-v6 package immediately. Rotate all secrets and keys from a different, uncompromised computer. Because the system may be fully compromised, consider rebuilding or thoroughly cleaning the affected machine to ensure removal of all malicious components. No official patch or fix is indicated; remediation relies on removal and secret rotation.