Ethereum smart contracts are being abused to host payload URLs that download malware via poisoned NPM packages, allowing attackers to fetch second-stage payloads. ReversingLabs found two malicious packages (colortoolsv2, mimelib2) that used smart contracts to deliver downloaders to developer systems.
-
Attack vector: NPM package poisoning using Ethereum smart contracts to host download URLs.
-
Targets: open-source developer environments and CI/CD workflows that import public packages.
-
Attribution & data: Binance links this vector to DPRK-linked actors; Chainalysis reports DPRK actors stole 61% of crypto in 2024.
Ethereum smart contract malware in NPM packages is rising — colortoolsv2 and mimelib2 used smart contracts to fetch downloaders; Binance links attacks to DPRK. Learn how.
Publication: COINOTAG — Published 2025-09-04 · Updated 2025-09-04
What is Ethereum smart contract malware in NPM packages?
Ethereum smart contract malware in NPM packages is a supply-chain attack where malicious code in a Node Package Manager library uses an on-chain smart contract to host or resolve URLs that point to second-stage downloaders. This method lets attackers hide payload locations off-chain and rotate addresses, complicating detection and takedown.
How did colortoolsv2 and mimelib2 deliver malware?
ReversingLabs identified two NPM packages — colortoolsv2 and mimelib2 — that contained a small bootstrap script. The script called an Ethereum smart contract to obtain the URL or command used to download the second-stage payload. The first file executed locally; the second file was retrieved dynamically, reducing static-detection effectiveness.
Why is this technique more dangerous than usual package poisoning?
Using smart contracts introduces persistence and obfuscation. Attackers can update on-chain pointers, rotate hosting URLs, and hide payload locations behind on-chain transactions. Developers trusting popular repositories may import malicious code from seemingly legitimate projects that have forged commit histories or fake contributor activity.
What evidence links these attacks to DPRK actors?
Major exchange security teams, including Binance security personnel, have reported increased NPM package poisoning as part of broader campaigns targeting crypto firms. Public reports and industry analyses indicate North Korean-linked groups (notably Lazarus) have focused on crypto theft; Chainalysis reports DPRK-linked actors were responsible for 61% of crypto theft in 2024, totaling $1.3 billion, and the FBI attributed the $1.4 billion Bybit hack to DPRK attackers.
What signs show a repository may be faked or malicious?
- Unusual commit patterns: thousands of rapid commits or automated-looking histories.
- Sparse genuine contributors: profiles with little authentic activity beyond that project.
- Package behavior: bootstrap scripts that call external hosts, decode obfuscated URLs, or resolve domains from non-standard sources (including smart contracts).
How can developers and firms detect poisoned NPM packages?
Front-load checks into CI: verify package source, audit recent commits, and sandbox-run new dependencies. Use deterministic dependency pinning, check package integrity signatures, and monitor for runtime network calls that resolve endpoints via smart contracts or decode obfuscated URLs.
How should exchanges and security teams respond?
Share indicators in private intelligence channels, rotate internal secrets, enforce strict supply-chain policies, and require mandatory code review for third-party dependencies. As reported by industry responders, exchanges already share poisoning alerts via private messaging groups to block malicious libraries quickly.
Frequently Asked Questions
Key Takeaways
- Supply-chain risk: Public NPM packages can be weaponized using on-chain smart contract pointers.
- Attribution matters: Industry sources and exchanges have connected package poisoning to DPRK-linked actors.
- Defense actions: Enforce dependency audits, sandbox installations, integrity checks, and cross-team threat intelligence sharing.
How-to: Quick developer checklist (structured)
- Pin dependencies and use verified package signatures.
- Audit bootstrap scripts for network calls or web3 interactions.
- Run packages in isolated sandboxes and monitor outbound requests.
- Verify contributor histories and repository metadata before trusting packages.
- Subscribe to internal incident channels and share indicators privately.
Conclusion
Ethereum smart contract-based downloaders embedded in poisoned NPM packages represent a notable escalation in supply-chain attacks against the crypto ecosystem. Organizations should treat public dependency use as a security control point, implement strict auditing, and coordinate threat intelligence across exchanges and security teams. For immediate mitigation, audit dependencies, sandbox new packages, and enforce signed packages in CI.
Author & Sources
Author: COINOTAG editorial team. Sources referenced as plain text: ReversingLabs research report, Binance security statements, Chainalysis reporting, FBI attribution of the Bybit incident.
