Ethereum Smart Contracts Exploited to Hide Malware in NPM Packages

Ethereum has become a new avenue for software supply chain attacks, with attackers leveraging smart contracts to conceal malicious code.

Researchers at ReversingLabs discovered two NPM packages—colortoolsv2 and mimelib2—that appeared to be simple utilities but were actually designed to fetch hidden URLs from Ethereum’s blockchain. These URLs directed compromised systems to download second-stage malware, allowing the attack to bypass traditional security detection.

NPM, the largest package registry for Node.js, provides developers access to millions of code modules, making it a prime target for malicious actors. The malicious packages were uploaded in July and initially appeared benign, masking their true intent by embedding commands within smart contracts. This tactic disguised the malicious activity as legitimate blockchain traffic, complicating detection efforts.

“This is something we haven’t seen previously,” said Lucija Valentić, a researcher at ReversingLabs. “It highlights how attackers are rapidly evolving their evasion strategies, targeting open-source repositories and developers.”

The technique builds on older attack methods that used trusted services like GitHub Gists, Google Drive, and OneDrive to host malicious links. By incorporating Ethereum smart contracts, attackers added a crypto-specific twist to a familiar supply chain tactic.

ReversingLabs noted that the malicious packages were tied to fake GitHub repositories posing as cryptocurrency trading bots, padded with fabricated commits, bogus user accounts, and inflated star counts to appear legitimate. Developers who installed the packages risked inadvertently importing malware.

Open-source supply chain risks are not new. In 2024, researchers identified over 20 malicious campaigns targeting developers through platforms like NPM and PyPI, often aiming to steal wallet credentials or install crypto miners. The new Ethereum-based approach demonstrates how attackers are adapting to blend into blockchain ecosystems.

Key Takeaways for Developers:

• Popular commits, active maintainers, and repository metrics can be faked.
• Even seemingly innocuous packages may carry hidden payloads.
• Vigilance is required when integrating open-source crypto tooling into projects.