MAL-2026-13937
Malicious code in @ethers-js/contracts (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (06aee7d1e943a9d9a705acf4f28286eb5460ab9a56057a0811274787478f7c68) Package impersonates the ethers project (real releases publish under `ethers` and `@ethersproject/*`, not `@ethers-js`). The `postinstall` lifecycle script in scripts/postinstall.js is obfuscated with \x-hex-encoded identifiers (require('fs'), require('https'), spawn('powershell',...)) and a base64-encoded download URL. On Windows, it decodes the URL to https://files.catbox.moe/7vixtr.zip, downloads the archive into %LOCALAPPDATA%\Microsoft\<random>, extracts it via PowerShell Expand-Archive, and then invokes a bundled pythonw.exe against r.py with {detached:true, windowsHide:true} and.unref(), executing attacker-controlled code hidden from the user on `npm install`.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for @ethers-js/contracts (npm). Pin to a known-safe version or switch to an alternative.