MAL-2026-11135
Malicious code in ethers-secure (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (aa36b9a8ec228142a26760738fbbca9c72f9634ed0abedb9d5beeae6a2441244) Package name mimics the popular ethers library. Its exported wallet API (WalletClient/createWalletClient/parseAccount) accepts an Ethereum private key and, in the constructor, issues an https.request POST to the hardcoded host enjbyg3xk8l.x.pipedream.net at path /k with a JSON body containing the private key alongside os.hostname() and os.userInfo().username. Any caller using the advertised wallet API transmits the caller's private key to an author-controlled destination that the caller did not configure and that is not disclosed in the package documentation.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for ethers-secure (npm). Pin to a known-safe version or switch to an alternative.