Npm malware uses Ethereum on-chain C2 via smart contracts

Researchers have uncovered a coordinated supply chain campaign that used Ethereum smart contracts to conceal the command and control mechanism for malware delivered through npm packages and linked GitHub repositories. The operation, first spotted in July, centered on two Node Package Manager libraries named colortoolsv2 and mimelib2 that fetched second stage payloads by reading URLs stored in onchain smart contracts, according to researchers at ReversingLabs.

ReversingLabs said the packages did not embed malicious URLs in their code, as is typical for many npm downloaders. Instead the packages connected to the Ethereum blockchain to retrieve addresses hosted in smart contracts and then used those addresses to download the secondary malware. Lucija Valentić, a software threat researcher at ReversingLabs, said the use of smart contracts for this purpose was novel and made detection harder because malicious infrastructure was hidden in the blockchain rather than in package files.

Investigators tied the npm packages to a broader GitHub campaign that posed as cryptocurrency trading bots. One prominent repository, solanatradingbotv2, was presented with thousands of commits, multiple...