LWA-2026-10833 confirmed malware
@ethers-js/contracts@6.9.0
Malicious code in @ethers-js/contracts (npm)
T1059.007 · JavaScriptT1059.003 · Windows Command ShellT1059.006 · PythonT1105 · Ingress Tool TransferT1195.002 · Compromise Software Supply Chain
Analysis
The postinstall hook (scripts/postinstall.js) is a Windows-targeted downloader. On win32 only, it creates a hidden directory under LOCALAPPDATA/TEMP named 'Microsoft/<random>', downloads a ZIP from hxxps://marxl[.]com/bin/wvt/swat/7aX0ci[.]zip, extracts it with powershell (Expand-Archive), then launches pythonw.exe r.py from the extracted contents as a detached background process and deletes the ZIP. The package name impersonates the ethers.js project.
- analyzed by
- Leitwacht
- first seen
- Aug 8, 2026, 11:37 AM
- analyzed
- Aug 8, 2026, 11:37 AM
Related advisories
- n8n-nodes-devops-utils@1.0.0
- txs-runner-lib@1.0.1
- txs-random-lib@1.0.1
- txs-builder@1.0.6
- node-fetch-utils@1.2.1
- anthropic-claude-latest@4.7.1
- txs-data@1.0.1
- solana-token-api@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.