Malicious npm Packages Impersonate Flashbots, Steal Ethereum Wallet Keys

A new set of four malicious npm packages impersonates Flashbots infrastructure to steal Ethereum wallet credentials, researchers reported, exfiltrating private keys and mnemonic seeds to a Telegram bot controlled by the threat actor. The packages were uploaded by a user named “flashbotts,” with the earliest library uploaded in September 2023 and the most recent on 19 August 2025, and they remain downloadable at the time of writing.

The four packages are @flashbotts/ethers-provider-bundle (52 downloads), flashbot-sdk-eth (467), sdk-ethers (90), and gram-utilz (83). According to Socket researcher Kush Pandya, the impersonation exploits trust in Flashbots, offering seemingly legitimate SDK functionality while covertly diverting sensitive data and, in one case, exfiltrating environment variables via SMTP to Mailtrap.

The report notes the libraries can log metadata from pre-signed transactions, redirect unsigned transactions to an attacker-controlled wallet, and transmit mnemonic seed phrases to the attacker’s Telegram channel, underscoring the risk of wallet compromise for developers adopting these packages. The findings also point to Vietnamese-language comments suggesting the attacker may be Vietnamese-speaking, highlighting a deliberate software supply chain attack aimed at Web3 developers.