Armando identified ethers-providerz v1.18.0 as the final version in a three-version malicious npm package cluster published on March 13, 2025. The package impersonates the legitimate ssh2 library and installs a downloader that fetches a second-stage Node.js payload from a remote C2 server, consistent with a reverse shell campaign also observed in the related package ethers-provider2. All 178 downloads of ethers-providerz occurred before npm removed it from the registry.
ethers-providerz claims to be "SSH2 client and server modules written in pure JavaScript for node.js," pointing to github.com/mscdex/ssh2 as its homepage. This directly impersonates the real ssh2 npm package maintained by Brian White. The package was first published on March 13, 2025, and version 1.18.0 was uploaded at 16:38 UTC -- about 77 minutes after the first version. All three versions are malicious and contact the same C2 server, confirming a coordinated campaign. The package was removed from npm and has zero direct dependents in the registry, but 178 total downloads suggest developers were exposed.
Like versions 1.16.0 and 1.17.0, ethers-providerz v1.18.0 declares an install lifecycle hook in package.json that points to install.js. Node.js executes this script automatically during npm install, before the installing project's own code runs.
The install script opens with a node-gyp rebuild call that mimics the native binding build step from the legitimate ssh2 package -- camouflage designed to make the script appear routine to a quick visual review. Immediately after, a self-invoking anonymous function calls twice on the string . The first decode yields another base64 string; the second yields the plaintext C2 URL .
%22%3E%0A%20%20%20%20%20%20%3Crect%20width%3D%2210%22%20height%3D%2220%22%20fill%3D%22%23f2930d%22%2F%3E%0A%20%20%20%20%20%20%3Crect%20x%3D%2210%22%20width%3D%2210%22%20height%3D%2220%22%20fill%3D%22%230d0d0d%22%2F%3E%0A%20%20%20%20%3C%2Fpattern%3E%0A%20%20%3C%2Fdefs%3E%0A%20%20%3Crect%20width%3D%221200%22%20height%3D%226%22%20fill%3D%22url(%23caution-stripe)%22%2F%3E%0A%3C%2Fsvg%3E){kind=small}
atobYUhSMGNEb3ZMelV1TVRrNUxqRTJOaTR4T2pNeE16TTNMMmx1YzNSaGJHdz0=http://5.199.166.1:31337/installThe script calls fetch on this URL, parses the JSON response, writes the value of jsondata["config"]["main"] to ./tmppppppppp.js, and executes it with node in a detached process. After execution, the temp file is deleted with fs.unlinkSync. Armando's analysis confirms that v1.18.0 and v1.17.0 share nearly identical install scripts, with the only functional difference being the placement of process.exit(0) inside the fetch callback in v1.18.0.
The secondary payload served by the C2 was not available for analysis. The C2 at 5.199.166.1 on port 31337 -- a port associated with hacking culture and reverse shell tooling -- is consistent with the reverse shell payload documented in the ethers-provider2 campaign.
install.js contacts http://5.199.166.1:31337/install after double-base64 decoding the URL at runtime. It writes the config.main value from the JSON response to ./tmppppppppp.js, spawns a detached Node.js process to execute it, and deletes the temp file. Detection: Script-JS.Downloader.SupplyChain.
package.json declares the install hook that triggers install.js, making it a direct enabler of the attack. Detection: Text.Downloader.SupplyChain.
Developers and security teams should take the following steps:
npm install while these versions were current should be considered potentially affected.tmppppppppp.js or similar temporary files.| Filename | SHA256 | Detection |
|---|---|---|
| install.js | faf17d44278785604900c14a7bc8909a8b18b115a75b7d52e1611f2b44efa0ed | Script-JS.Downloader.SupplyChain |
| package.json | 7cc21384fd2b6736b3ecaca02487a231a8f906c09ed5e7cb258d39cb5928f2e3 | Text.Downloader.SupplyChain |
| URL / IP | Purpose |
|---|---|
| http://5.199.166.1:31337/install | C2 endpoint -- delivers second-stage Node.js payload via JSON response config.main field |
| File | SHA256 |
|---|---|
| ethers-providerz-1.18.0.tgz | e57d1122e0bbc4e4c87dfd1a2dee4ca5d49883817d6f9871cb5888c3a170c5d4 |
| ethers-providerz-1.18.0.tar | 62e597aced7bf630dcd01b4ab815ea846ad04c74403b125b2aa694346b78d64a |