Malicious actors have found a way to hide open-source malware in Ethereum smart contracts, as per a recent report.
On Sep. 3, the software security firm ReversingLabs released a report as per which hackers used code to hide command-and-control (C2) instructions within two Node Package Manager (NPM) packages.
Node Package Manager (NPM) is the default package manager for Node.js, used to install, manage, and share reusable code packages (also called modules) for JavaScript projects.
The two exploited NPM packages, both uploaded in July, are:
-
colortoolsv2
-
mimelib2
The dangerous code allowed the malware to evade security detection and ask for the next-stage payload location instead of hard-coding links in the package itself.
More News:
The report added,
"Software supply chain attacks targeting cryptocurrency software and infrastructure aren't new."
Ledger CTO warns crypto users to be cautious
Charles Guillemet, CTO at the crypto wallet platform Ledger, warned the crypto community to be cautious while executing transactions.
"The malicious payload works by silently swapping crypto addresses on the fly to steal funds."
Guillemet asked those using a hardware crypto wallet to pay attention to every transaction before signing to keep their virtual assets safe. He asked those using a software wallet to refrain from making any transactions for now.
"If you use a Ledger or hardware wallet with clear signing, you are not at risk," he added.
The exploited NPM packages have been downloaded over 1 billion times, which means the entire JavaScript ecosystem may be at risk, Guillemet warned.
The latest incident only shows how malicious actors can use extremely sophisticated methods to exploit the cyber ecosystem.
This story was originally reported by TheStreet on Sep 8, 2025, where it first appeared in the MARKETS section. Add TheStreet as a Preferred Source by clicking here.
