Hackers have developed a new technique to hide malicious software within Ethereum smart contracts, allowing them to bypass traditional security scans.
This new method was uncovered by researchers at ReversingLabs, who discovered two malicious packages, “colortoolsv2” and “mimelib2,” on the Node Package Manager (NPM) repository.
Instead of directly embedding malicious links, these packages use a novel approach.
Your completely free resource hub designed to boost your knowledge of cryptocurrencies
They are designed to query the Ethereum blockchain to retrieve the addresses of command and control servers. This makes it much harder for security systems to detect the threat, as the packages simply appear to be performing legitimate blockchain transactions.
Once they fetch the malicious URLs, they download a second-stage malware payload onto the compromised device.
A New Attack Vector
While malware targeting crypto users isn’t new, the use of smart contracts to conceal these malicious commands is an evolving strategy.
According to ReversingLabs researcher Lucija Valentić, this technique demonstrates how quickly threat actors are adapting their methods to evade detection.
A Broader Deception Campaign
This recent discovery is part of a larger social engineering effort.
The malicious packages were linked to an elaborate campaign on GitHub where hackers created fake cryptocurrency trading bot repositories.
These repositories were designed to appear legitimate with fabricated commits, fake user accounts, and professional-looking documentation to trick developers into trusting the code.
This new attack vector highlights how hackers are combining different technologies, like blockchain and social engineering, to create more sophisticated threats.
Similar campaigns have been seen on other blockchains, with fake Solana trading bot repositories being used to steal wallet credentials and attacks targeting the open-source Bitcoinlib library.
The discovery of this new technique underscores the need for developers and security professionals to remain vigilant as attackers continue to find new ways to exploit open-source repositories.
