Attackers are using Ethereum smart contracts to hide malicious URLs within NPM packages, complicating detection and posing a supply chain risk.

Executive Summary

Attackers are leveraging Ethereum smart contracts to conceal malicious URLs within NPM packages, making detection harder and posing a supply chain risk. This novel approach marks an evolution in cyberattack strategies targeting the crypto and Web3 ecosystems.

The Event in Detail

In early July, ReversingLabs researcher Karlo Zanki discovered a malicious package named “colortoolsv2” on NPM. A duplicate package, “mimelib2,” was subsequently published after the initial package was removed. Both packages deployed a second-stage malware payload through blockchain infrastructure. Instead of embedding URLs or scripts directly within the package, the packages used Ethereum smart contracts to store and deliver URLs for fetching the second-stage malware. This tactic makes detection significantly harder, as the malicious infrastructure is hidden within the blockchain code rather than inside the package files.

Market Implications

The use of Ethereum smart contracts to conceal malicious commands represents a new evasion strategy. According to ReversingLabs’s 2025 Software Supply Chain Security report, there were 23 such campaigns in 2024, including a compromise of the PyPI package ultralytics in December that delivered a coin miner. The Ethereum ecosystem and open-source crypto tooling face decreased trust because of this vulnerability.

Expert Commentary

ReversingLabs researchers stated that the use of smart contracts to load malicious commands is something they haven't seen previously and highlights the fast evolution of detection evasion strategies by malicious actors.

Broader Context

The crypto industry faces an increasing number of cyberattacks. In the first half of 2025, $2.47 billion in digital assets were stolen through hacking incidents. A single incident in February resulted in a $1.5 billion loss for Bybit. The decline in the U.S. share of open-source developers from 25% in 2021 to 18% in 2025, citing “lack of regulatory clarity” as the main driver.