Cybercriminals are embedding malicious commands in Ethereum smart contracts, complicating detection for security systems.
Smart Contracts as Hosts for Malware
Research from ReversingLabs has revealed that attackers are uploading malicious packages to the Node Package Manager (NPM) repository, one of the largest hubs for JavaScript libraries. The packages "colortoolsv2" and "mimelib2," released in July, disguised themselves as legitimate tools and fetched command-and-control (C2) addresses from Ethereum smart contracts, bypassing standard security protocols.
A New Twist on Old Attacks
While using smart contracts for malware is not a new phenomenon, recent attacks suggest a novel approach. Instead of merely hiding malware within contracts, attackers are now embedding the very URLs for payload delivery inside Ethereum’s decentralized infrastructure.
Social Engineering in Cyber Threats
The malicious packages were part of a larger deception campaign targeting developers through GitHub repositories. Threat actors built fake cryptocurrency trading bot projects complete with fabricated commits, multiple fake maintainers, and polished documentation to establish credibility. These repositories lured unsuspecting developers into downloading the infected packages, further spreading the malware.
This incident underscores how attackers are merging blockchain technology with social engineering to bypass traditional security tools.
