Hackers have begun using Ethereum smart contracts to secretly download malware

Key points:

• ReversingLabs discovered NPM libraries using Ethereum smart contracts to download malware.
• The libraries masked commands as legitimate blockchain traffic, making them difficult to detect.
• The incident was part of a large-scale campaign involving fake crypto repositories on GitHub.

Attackers have found a new way to bypass security systems: they embed commands to download malware into Ethereum smart contracts. This was reported by researchers at ReversingLabs, who studied two NPM libraries — colortoolsv2 and mimelib2 — uploaded in July 2025.

According to ReversingLabs researcher Lucija Valentić:

“That’s something we haven’t seen previously, and it highlights the fast evolution of detection evasion strategies by malicious actors who are trolling open source repositories and developers.”

How the attack worked

The libraries consisted of just a couple of files: the index.js script extracted and executed malicious commands. Instead of placing malicious links directly in the code, the attackers used Ethereum smart contracts as a source of URLs to download the second stage payload.

Previously, trusted services such as GitHub Gist or Google Drive were more commonly used for such purposes.

Source: reversinglabs.com

A fragment of the Ethereum smart contract used to download malicious commands.

Large-scale campaign via GitHub

ReversingLabs discovered that the colortoolsv2 and mimelib2 libraries were part of a broader social engineering campaign.

Fake projects, such as solana-trading-bot-v2, were posted on GitHub, imitating legitimate cryptocurrency trading tools. The repositories were filled with thousands of “empty” code changes, fake stars, and watcher accounts to instill trust in developers. In reality, their task was to distribute malicious npm dependencies.

The fake GitHub repository solana-trading-bot-v2 used to distribute malicious code.

Significance of the attack and researchers’ conclusions

The incident was a continuation of the trend of attacks on the software supply chain. In 2024, ReversingLabs recorded 23 similar campaigns, many of which targeted the crypto community and wallets.

What is new about the current case is the use of Ethereum smart contracts as a command delivery tool, which makes attacks more difficult to detect.

The analysis recorded specific hashes of malicious libraries and the address of the smart contract on the Ethereum network through which the commands were downloaded. This data is published as indicators of compromise (IoC) and can be used by specialists to detect infections.