Cybersecurity researchers at ReversingLabs have discovered a new form of attack where malicious actors abuse Ethereum smart contracts to spread malware. Two malicious packages, “colortoolsv2” and “mimelib2,” were posted to the Node Package Manager (NPM) repository in July, Vai as downloaders that hide malicious commands inside smart contracts. Once installed, they query the blockchain for the address of the control server, from which they download the second-stage malware, making detection difficult because the traffic looks legitimate.
The campaign was also deployed via GitHub, with fake cryptocurrency trading bot code repositories, fake accounts, and fake documents to create credibility. According to ReversingLabs, at least 23 similar campaigns were recorded in 2024, showing that cybercriminals are increasingly sophisticated, combining blockchain with social engineering to bypass security controls.
