Ethereum has become the latest front for software supply chain attacks.

Researchers at ReversingLabs earlier this week uncovered two malicious NPM packages that used Ethereum smart contracts to conceal harmful code, allowing the malware to bypass traditional security checks.

NPM is a package manager for the runtime environment Node.js and is considered the world’s largest software registry, where developers can access and share code that contributes to millions of software programs.

The packages, “colortoolsv2” and “mimelib2,” were uploaded to the widely used Node Package Manager repository in July. They appeared to be simple utilities at first glance, but in practice, they tapped Ethereum’s blockchain to fetch hidden URLs that directed compromised systems to download second-stage malware.

By embedding these commands within a smart contract, attackers disguised their activity as legitimate blockchain traffic, making detection more difficult.

“This is something we haven’t seen previously,” ReversingLabs researcher Lucija Valentić said in their report. “It highlights the fast evolution of detection evasion strategies by malicious actors who are trolling open source repositories and developers.”

The technique builds on an old playbook. Past attacks have used trusted services like GitHub Gists, Google Drive, or OneDrive to host malicious links. By leveraging Ethereum smart contracts instead, attackers added a crypto-flavored twist to an already dangerous supply chain tactic.

The incident is part of a broader campaign. ReversingLabs discovered the packages tied to fake GitHub repositories that posed as cryptocurrency trading bots. These repos were padded with fabricated commits, bogus user accounts, and inflated star counts to look legitimate.

Developers who pulled the code risked importing malware without being aware of it.

Supply chain risks in open-source crypto tooling are not new. Last year, researchers flagged more than 20 malicious campaigns targeting developers through repositories such as npm and PyPI.

Many were aimed at stealing wallet credentials or installing crypto miners. But the use of Ethereum smart contracts as a delivery mechanism shows adversaries are adapting quickly to blend into blockchain ecosystems.

A takeaway for developers is that popular commits or active maintainers can be faked, and even seemingly innocuous packages may carry hidden payloads.

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。