The npm package ethers-signer version 3.2.1 is a typosquatting malicious package impersonating @ethersproject/abstract-signer. When imported, it collects all environment variables and system information such as hostname, username, home directory, platform, and current working directory. This data is base64-encoded and exfiltrated via an HTTPS GET request to a Telegram bot controlled by the attacker. The package attempts to hide its malicious behavior by re-exporting the legitimate @ethersproject/abstract-signer module. A flag file prevents repeated data exfiltration on the same host.