MalwarePublished 4 Sep 2025

Ethereum smart contracts used to push malicious code on npm

Source AlienVault OTX General

Description

A novel technique utilizing Ethereum smart contracts was discovered in two npm packages to conceal malicious commands for installing downloader malware. The packages, colortoolsv2 and mimelib2, are part of a larger campaign targeting npm and GitHub. The attackers created sophisticated GitHub repositories with fake popularity metrics to lure developers. The campaign focused on cryptocurrency-related projects, using blockchain technology to evade detection. This incident highlights the evolving strategies of malicious actors in compromising open-source repositories and the need for developers to carefully assess third-party packages before implementation.

Impact

European organizations, especially those involved in software development, fintech, and cryptocurrency sectors, face considerable risk from this threat. The use of npm packages is widespread across Europe, and many enterprises integrate open-source components into their software supply chains. Compromise of these packages can lead to the introduction of downloader malware into development environments, potentially resulting in intellectual property theft, unauthorized access to internal systems, or the deployment of ransomware and other malware. The focus on cryptocurrency-related projects increases the risk for European fintech companies and blockchain startups, which are prominent in countries like Germany, the Netherlands, and Switzerland. Additionally, the stealthy nature of the attack leveraging Ethereum smart contracts complicates detection and response, increasing the likelihood of prolonged undetected compromise. This can undermine trust in open-source ecosystems and disrupt software development lifecycles, causing operational delays and financial losses.

Defensive guidance

1. Implement strict vetting and validation processes for all third-party npm packages, especially those related to cryptocurrency or blockchain. 2. Use automated tools to analyze package dependencies and detect unusual behaviors, such as network calls to blockchain nodes or execution of scripts that interact with smart contracts. 3. Employ sandboxing and behavioral analysis in CI/CD pipelines to detect downloader or command execution activities before deployment. 4. Monitor for unusual outbound network traffic from development environments, particularly connections to Ethereum nodes or blockchain APIs. 5. Educate developers on the risks of blindly trusting package popularity metrics and encourage verification of package provenance and maintainers. 6. Maintain an allowlist of approved packages and versions, and regularly audit dependencies for updates or suspicious changes. 7. Collaborate with open-source communities to report and remediate malicious packages promptly. 8. Integrate threat intelligence feeds that include hashes and indicators related to this campaign to enhance detection capabilities. 9. Limit permissions and isolate build environments to reduce the impact of potential compromise. 10. Consider using package integrity verification mechanisms such as npm’s package signing or reproducible builds to detect tampering.

Indicators of compromise

Hashes 6

021d0eef8f457eb2a9f9fb2260dd2e391f009a21
1bb7b23f45ed80bce33a6b6e6bc4f99750d5a34b
678c20775ff86b014ae8d9869ce5c41ee06b6215
bda31e9022f5994385c26bd8a451acf0cd0b36da
c5488b605cf3e9e9ef35da407ea848cf0326fdea
db86351f938a55756061e9b1f4469ff2699e9e27

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 4 Sep 2025, 10:19 UTC

MITRE ATT&CK techniques8 from threat tags

Technical details

Indicators of compromise

Hashes 6

Community reviews

Related threats