A sophisticated new attack vector is silently targeting developers, leveraging the inherent properties of the Ethereum blockchain to conceal malware operations. Attackers are embedding malicious code within seemingly innocuous npm packages, transforming smart contracts into resilient, difficult-to-dismantle command and control (C2) channels. This innovative approach significantly complicates detection and takedown efforts, posing a fresh challenge to software supply chain security.
Leveraging Blockchain for Covert Operations
The core of this attack involves malicious npm packages, such as colortoolsv2 and mimelib2, which do not hardcode their command infrastructure. Instead, upon installation, these packages execute scripts that query a specific Ethereum smart contract to fetch a URL. This URL then directs the package to download a second-stage malware payload, effectively using the blockchain as a dynamic, immutable pointer to their C2 servers. The initial promotion of these packages often occurs through elaborate social engineering tactics, including networks of bogus GitHub repositories impersonating trading bots. These fake repos feature inflated commit histories, artificial stars, and sock-puppet maintainers, all designed to lure unsuspecting developers into installing the malicious dependencies. This method drastically reduces static indicators, making the threat harder to spot during routine code reviews and further enhancing the malware's stealth.
The Resilience of On-Chain Command and Control
This technique is not entirely new, echoing a broader campaign from late 2024 that utilized hundreds of npm typosquats to query Ethereum contracts for OS-specific payloads. However, the 2025 variant shows an evolution, with the smart contract now hosting the URL for the next stage rather than the payload itself, offering greater flexibility and deniability to attackers. The choice of Ethereum for C2 provides attackers with distinct advantages: immutability ensures the C2 information cannot be altered, public readability allows any infected machine to retrieve the necessary data, and its decentralized nature makes it incredibly difficult for defenders to take offline or shut down. To protect against these advanced supply chain attacks, immediate controls include preventing lifecycle scripts from running during npm install and npm ci using the --ignore-scripts flag. Additionally, organizations should enforce strict version pinning, conduct rigorous reviews of package maintainers and metadata, block outbound traffic to known indicators of compromise, and implement alerts for build logs that initiate ethers.js calls to getString(address). While the specific malicious packages may be removed, the underlying pattern of on-chain indirection remains a persistent threat, requiring vigilant and evolving defense strategies.
