MalwarePublished 20 May 2026Updated 1 Sep 2026

ethers-wallet-packages (npm) · Malicious Code

Affects ethers-wallet-packagesSource GCVE Database

What to do

Affected software

Product	Affected	Fixed in
npmethers-wallet-packages	Affected =5.8.0 =5.8.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The ethers-wallet-packages npm package is a malicious typosquat impersonating the legitimate @ethersproject/wallet package. It contains code that silently exfiltrates users' Ethereum private keys or mnemonic secrets to an attacker-controlled Telegram bot whenever the Wallet constructor is called. This compromises the victim's Ethereum funds and potentially the entire host system. The affected versions are 5.8.0 and 5.8.2. Removal of the package alone may not fully remediate the compromise, as the attacker may have gained broader control over the system.

Impact

Any user installing or running this malicious package risks immediate compromise of their Ethereum private keys or mnemonic secrets, resulting in full loss of control over their Ethereum funds. Because the package silently transmits these secrets to an attacker-controlled Telegram bot, attackers can steal funds without user knowledge. Additionally, the presence of this package indicates a potentially fully compromised system, as attackers may have installed further malicious software. Secrets and keys stored on the affected system should be considered compromised and rotated from a secure environment.

Defensive guidance

Users should immediately remove the malicious ethers-wallet-packages package from their systems. All Ethereum private keys, mnemonics, and related secrets that were used on the compromised system must be considered exposed and rotated from a different, secure computer. Due to the potential for full system compromise, a full system audit and reinstallation from a trusted source is recommended. Monitor for any unauthorized access to Ethereum accounts and consider additional security measures such as hardware wallets.

Summary

This malicious npm package named ethers-wallet-packages impersonates the legitimate @ethersproject/wallet package by copying its source files and internal version string 'wallet/5.8.0'. It injects a msgLog() call inside the Wallet constructor that sends the constructor's first argument—which can be a raw Ethereum private key, an ExternallyOwnedAccount object, or a mnemonic-bearing object—to a hardcoded Telegram bot endpoint. This exfiltration occurs silently and grants the attacker full control over the victim's Ethereum assets. The attack is identified by three signals: typosquatting of a popular ethers package, a hardcoded attacker command-and-control endpoint with embedded bot token and chat_id, and silent relay of secret material through the public API. The affected versions are exactly 5.8.0 and 5.8.2. The compromise may extend beyond the package itself, potentially affecting the entire host system.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 8 Sep 2026, 10:22 UTC

Technical details

References

Community reviews