Hackers Learn to Hide Malware in Ethereum Smart Contracts

In a groundbreaking development, researchers from ReversingLabs have unearthed a novel method of spreading malware using Ethereum smart contracts. These contracts are employed for the covert delivery of commands and links, posing a significant challenge to standard cybersecurity tools. According to the researchers, hackers embedded infected packages into public repositories, exploiting blockchain features to dodge typical protective measures.

Technical Breakdown: How It Works

Users who downloaded two malicious packages—colortoolsv2 and mimelib2—from NPM, the largest JavaScript library repository, found themselves at risk. Published in July 2025, these packages did not contain direct links to control servers. Instead, they retrieved these links from Ethereum smart contracts, making network traffic appear legitimate and complicating detection efforts.
Upon installation, the packages connected to the blockchain to extract server addresses and download the second phase of malware. This mechanism effectively turned standard smart contracts into tools for URL camouflage, helping attackers bypass automated security checks.

A New Frontier in Cyber Attacks

ReversingLabs highlights that while using blockchain in attacks is not new—previously seen with groups like Lazarus—the current approach stands out because Ethereum contracts aren’t used for file distribution but for hosting control links. This represents an unprecedented evolution in evasion techniques.
The malicious packages were part of a larger social engineering campaign where attackers created fake GitHub repositories masquerading as crypto trading bots. They added fake commits and multiple observer accounts while publishing professionally crafted documentation to mimic real developer activity.

Broader Implications on Open Source Security

Attacks on open repositories are becoming more prevalent. In 2024 alone, there were at least 23 campaigns related to digital assets targeting various ecosystems beyond Ethereum. For instance, a fake bot targeting Solana was spread online in April, stealing cryptocurrency wallets. Similar attacks previously targeted Bitcoinlib—a popular Python library for Bitcoin.
Experts see this blend of blockchain technology with social engineering as a testament to hackers’ growing ingenuity. Such methods bypass traditional defenses and pose an escalating threat to developers and users of open-source software.
As noted earlier this year in August 2025, losses from hacker attacks exceeded $163 million industry-wide—highlighting the severe impact these sophisticated strategies can have on the crypto market and beyond.
This article serves as both a warning and insight into the evolving landscape of cyber threats within cryptocurrency ecosystems. It is crucial for stakeholders across industries engaging with digital currencies and open-source projects to remain vigilant against such advanced attack methodologies.