MALICIOUS NPM PACKAGES USE ETHEREUM BLOCKCHAIN FOR MALWARE DELIVERY

Summary from the TLDR InfoSec newsletter

Attackers deployed fake GitHub repositories and npm packages that stored malware download URLs in Ethereum smart contracts rather than directly in the code, making detection significantly harder for security tools. The campaign targeted cryptocurrency developers with fake automated trading bots, using packages like colortoolsv2 and mimelib2 that connected to blockchain addresses to retrieve second-stage payloads. The attackers automated thousands of fake commits daily to inflate repository legitimacy, demonstrating sophisticated supply chain attack techniques that combine social engineering with blockchain-based evasion.