Beware ETH Smart Contracts per Coin Telegraph (Patreon)

🚨 ALERT: Hackers are hiding malware in Ethereum smart contracts, disguising malicious traffic as normal blockchain activity, ReversingLabs reports.

According to a report by ReversingLabs, hackers are using Ethereum smart contracts to conceal malicious commands within seemingly legitimate blockchain traffic. Specifically, two Node Package Manager (npm) packages, "colortoolsv2" and "mimelib2," uploaded in July 2025, were found to act as downloaders that queried Ethereum smart contracts to retrieve URLs for command-and-control (C2) servers. These URLs facilitated the delivery of second-stage malware, making detection difficult as the blockchain interactions appeared as normal activity. This tactic evades traditional security scans, which typically flag hardcoded malicious links but struggle with decentralized blockchain queries.

The campaign extended to fake GitHub repositories posing as cryptocurrency trading bots, such as "solana-trading-bot-v2," bolstered by fabricated commits, fake user accounts, and inflated metrics to appear trustworthy. This social engineering, combined with blockchain's inherent legitimacy, marks an evolution in software supply chain attacks. ReversingLabs noted 23 similar crypto-related campaigns in 2024, indicating a growing trend. Developers are urged to audit dependencies, use blockchain-aware security tools, and adopt a zero-trust approach to mitigate such threats.