Cybersecurity firm ReversingLabs has uncovered a sophisticated new attack method in the open-source software supply chain. Two malicious NPM packages, colortoolsv2 and mimelib2, released in July, acted as Trojan horses that leveraged Ethereum smart contracts to dynamically retrieve command-and-control (C2) server addresses.

? Hackers exploit Ethereum smart contracts to inject malware into popular NPM coding libraries through packages like "colortoolsv2" that conceal malicious commands.#Blockchain #Hackhttps://t.co/F6OoWGKZ91

— Cryptonews.com (@cryptonews) September 4, 2025

Blockchain Obfuscation as a Cover

Unlike traditional malware that embeds malicious URLs directly in the code, these packages contained only lightweight downloaders. Instead of hardcoded links, they queried Ethereum smart contracts to fetch the latest C2 addresses, then downloaded a second-stage payload.

This innovation makes detection significantly harder:

• Static code analysis reveals no obvious indicators of compromise (IOCs).

• Network activity resembles legitimate blockchain queries rather than malicious traffic.

Security experts warn that this represents an unprecedented method of “on-chain malware command delivery”, embedding attacker instructions directly on the blockchain rather than external repositories.

Threat to Open-Source Software Supply Chains

The attackers disguised their malware as legitimate GitHub repositories, posing as crypto trading bots. With professional-looking documentation, multiple maintainer accounts, and consistent commits, the projects appeared credible. Developers who unknowingly installed these utilities only faced threats once the secondary malware was fetched.

This hybrid of open-source infrastructure and Web3 elements makes detection far more complex and could mark a new standard for supply-chain attacks.

Red Flags for Developers

Experts recommend developers and security teams stay alert to warning signs such as:

• Unexplained use of Web3 libraries or RPC calls in packages without blockchain functionality.

• Suspicious requests to Ethereum nodes.

• Obfuscated code used solely for downloading or executing files.

• References to unknown smart contract addresses without clear documentation.

While these alone don’t confirm an attack, they justify sandboxing and quarantining. Security teams are also urged to expand IOC lists to include smart contract addresses, not just IPs, domains, or file hashes.

A Dangerous Precedent for Future Attacks

Although downloads of colortoolsv2 and mimelib2 remain limited, experts warn the attack represents a dangerous precedent. By combining modular attack stages, harmless-looking packages, blockchain-powered C2 lookups, and dynamic malware delivery, adversaries are testing creative new methods to evade detection.

The open-source software supply chain remains a high-risk battlefield and attackers are evolving faster than ever.