Malicious npm Packages Impersonate Flashbots SDKs to Steal Ethereum Wallet Credentials

On 9 September 2025, Socket’s Threat Research Team disclosed a coordinated supply-chain attack targeting the Ethereum ecosystem via four malicious npm packages impersonating Flashbots tooling. According to Socket’s Threat Research Team, the packages—ethers-provider-bundle, flashbot-sdk-eth, sdk-ethers, and gram-utilz—were published under the npm alias flashbotts with the registration email aning2028@gmail.com[.]com and were designed to steal cryptocurrency wallet credentials.

The packages masquerade as legitimate cryptographic utilities and Flashbots MEV infrastructure while exfiltrating private keys and mnemonic seeds to a Telegram bot controlled by the threat actor, using the Telegram bot ID 8083151136. Four variants implement different credential-theft mechanisms, including environment-variable harvesting and redirection of unsigned transactions, with approximately 95% of the package code described as benign to avoid suspicion.

The researchers warn that a single installation could compromise trading bot wallets, MEV searcher hot wallets, development/test wallets, and smart-contract deployment keys, and note that the packages remained live on npm at the time of reporting.