Hackers Use Ethereum Contracts to Hide Malware on NPM

Hackers Use Ethereum Smart Contracts to Mask Malware in NPM Packages

Written by Aaron S.,

Editor-In-Chief

Last Updated: September 05, 2025

Key Takeaways

Hackers hid malware locations in Ethereum smart contracts to bypass scans and avoid detection in NPM packages;
Two fake JavaScript tools, "colortoolsv2" and "mimelib2", pulled malware links from the blockchain after installation;
The campaign also used a fake GitHub crypto bot project with fake activity to lure developers into installing the malware.

Ace quick missions & earn crypto rewards while gaining real-world Web3 skills. Participate Now! 🔥

BITDEGREE IN YOUR SOCIAL FEED

Hackers have discovered a new method for spreading malicious software by using Ethereum ETH $4,352.56 smart contracts to conceal crucial aspects of their attacks.

According to a blog post by Lucija Valentić at ReversingLabs, two suspicious software packages were found on the Node Package Manager (NPM), a platform used to share JavaScript code.

These packages, named "colortoolsv2" and "mimelib2", were uploaded in July and designed to look like regular tools.

What is a Crypto Bull Run? (Animated Explainer + Prediction)

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe - We publish new crypto explainer videos every week!

The packages acted like simple downloaders. When someone installed one, it would reach out to the Ethereum blockchain and fetch data from a smart contract. That data contained the location of a second piece of malware, which would then be downloaded and installed.

This made it hard for security systems to flag the packages as harmful, since they did not include any direct links to malicious websites or files.

Valentić explained that while Ethereum contracts have been misused before, this setup was different. In this case, the smart contract did not hold the malware itself, but held the location where it could be found.

The campaign was not limited to NPM. It also involved a fake open-source project hosted on GitHub. Hackers created a fake cryptocurrency trading bot, complete with fake updates, detailed documentation, and several user accounts to make the project seem active and trustworthy.

On September 1, SlowMist’s Yu Xian reported that attackers stole WLFI tokens from Ethereum wallets. How? Read the full story.