Malicious code in ethers.json (npm)

The ethers.json npm package version 6.15.0 has been identified as containing malicious code. Installation or execution of this package leads to a full compromise of the affected computer. This includes potential unauthorized access and control by an external entity. Due to the severity of the compromise, all sensitive credentials on the system must be rotated from a secure environment. The malicious package is linked to the advisory GHSA-q64r-f9q5-x6m3 and is cataloged under MAL-2026-11298 in the OSV database. No CVSS score is available for this threat.

Any system with ethers.json version 6.15.0 installed or running is considered fully compromised. Attackers may have gained full control, risking exposure or theft of all secrets and keys stored on the system. The compromise is severe enough that simply uninstalling the package may not remove all malicious components or backdoors.

Immediate removal of ethers.json version 6.15.0 is recommended. However, because the system may be fully compromised, all secrets and keys stored on the affected computer should be rotated from a different, trusted machine. There is no official patch or fix available; remediation relies on removal and credential rotation. Users should verify system integrity and consider rebuilding the affected environment.