Open Source Poisoned Patches Infect Local Software

Researchers observed malicious npm packages that stealthily patch locally installed software: pdf-to-office searches for Atomic and Exodus wallets and replaces a wallet component to redirect outgoing transactions to attacker-controlled addresses, while ethers-providerz and ethers-provider2 inject code into the ethers library to provide a reverse shell. This poisoned-patching technique is persistent (the wallet remains compromised after removal of the malicious package) and is a stealthy supply-chain style tactic that can enable theft and remote access.