This malicious npm package named ethers-wallet-packages impersonates the legitimate @ethersproject/wallet package by copying its source files and internal version string 'wallet/5.8.0'. It injects a msgLog() call inside the Wallet constructor that sends the constructor's first argument—which can be a raw Ethereum private key, an ExternallyOwnedAccount object, or a mnemonic-bearing object—to a hardcoded Telegram bot endpoint. This exfiltration occurs silently and grants the attacker full control over the victim's Ethereum assets. The attack is identified by three signals: typosquatting of a popular ethers package, a hardcoded attacker command-and-control endpoint with embedded bot token and chat_id, and silent relay of secret material through the public API. The affected versions are exactly 5.8.0 and 5.8.2. The package is not a cloud service, and no official patch or remediation is documented. The compromise may extend beyond the package itself, potentially affecting the entire host system.

Any user installing or running this malicious package risks immediate compromise of their Ethereum private keys or mnemonic secrets, resulting in full loss of control over their Ethereum funds. Because the package silently transmits these secrets to an attacker-controlled Telegram bot, attackers can steal funds without user knowledge. Additionally, the presence of this package indicates a potentially fully compromised system, as attackers may have installed further malicious software. Secrets and keys stored on the affected system should be considered compromised and rotated from a secure environment.

No official patch or fix is available. Users should immediately remove the malicious ethers-wallet-packages package from their systems. All Ethereum private keys, mnemonics, and related secrets that were used on the compromised system must be considered exposed and rotated from a different, secure computer. Due to the potential for full system compromise, a full system audit and reinstallation from a trusted source is recommended. Monitor for any unauthorized access to Ethereum accounts and consider additional security measures such as hardware wallets.