Malicious npm Packages Exploit Ethereum Smart Contracts to Target Crypto Developers

Cybersecurity researchers have detected two malicious npm packages, colortoolsv2 and mimelib2, uploaded to npm in July 2025 and no longer available for download. The packages abuse Ethereum smart contracts to stage the URLs hosting the payload, enabling a next-stage downloader to run on compromised systems, a technique described as resembling EtherHiding.

The two packages attracted only seven and one downloads respectively, and are part of a broader campaign impacting both npm and GitHub, with GitHub projects importing the libraries appearing credible at first glance, according to ReversingLabs. Found within a network of GitHub repositories linked to a Solana-trading-bot-v2 project, the campaign is associated with a distribution-as-a-service cluster named Stargazers Ghost Network, which stars and forks malicious repositories to inflate their apparent popularity.

ReversingLabs’ Lucija Valentić urged developers to assess each library before inclusion, emphasising scrutiny of maintainers and open-source package provenance, not just download counts. According to ReversingLabs, these packages exemplify threat actors’ evolving tactics to evade detection by leveraging on-chain data and smart contracts.