Malware found on npm infecting local package with reverse shell

This ReversingLabs analysis describes an npm-based malware campaign in which malicious packages (ethers-provider2, ethers-providerz and related packages) download multi-stage payloads, patch locally installed legitimate packages (like ethers and @ethersproject/providers) to insert loader code and a reverse shell connecting to 5.199.166.1, and achieve persistence even after removal of the malicious package; the report includes technical details, a YARA rule for detection, and collected IOCs.