Crypto as a Weapon: Malicious npm Packages Use Ethereum Smart Contracts for C2

Researchers from ReversingLabs have discovered two malicious npm packages that use Ethereum smart contracts to conceal and deliver malware, identified as colortoolsv2 and mimelib2 in July 2025. The campaign began with the publication of colortoolsv2 on July 7, and, shortly after its removal from npm, attackers replaced it with a nearly identical package named mimelib2 containing the same malicious code.

According to ReversingLabs, the two npm packages abused smart contracts to conceal malicious commands that installed downloader malware on compromised systems. Ethereum smart contracts were repurposed as covert command-and-control servers, embedding malicious commands within a contract to make the infrastructure more resilient and harder to takedown than a traditional server.

The researchers also observed deceptive activity on GitHub, including a solana-trading-bot-v2 repository that appeared to be a popular tool but whose details were fabricated, with accounts forking and starring the project to simulate legitimacy. This combination of social engineering and technical novelty highlights the evolving evasion tactics used to lure developers into trusting open-source code.