Hackers Use Ethereum Smart Contracts to Hide Malware and Bypass Security Detection

According to ChainCatcher, ReversingLabs researchers have disclosed that the NPM packages "colortoolsv 2" and "mimelib 2," released in July, use Ethereum smart contracts to hide malicious URLs and evade security scans. These packages function as downloaders, retrieving command and control server addresses from smart contracts and then downloading second-stage malware, making blockchain traffic appear legitimate and thus increasing detection difficulty.

The research points out that this is the first time Ethereum smart contracts have been found hosting malicious command URLs, indicating that attackers’ strategies to evade detection in open-source repositories are rapidly evolving.