Ethereum smart contracts used to push malicious code on npm

ReversingLabs researchers discovered a supply-chain campaign on npm and GitHub where malicious packages (colortoolsv2, mimelib2) used Ethereum smart contracts to hide C2 commands that deliver downloader/second-stage malware; the campaign also employed fake GitHub repositories, fabricated stars/watchers and automated commits to appear legitimate. The report details the technique (smart-contract-hosted commands), the broader GitHub deception infrastructure, observed IOCs, and recommends developers rigorously vet dependencies and maintainers to reduce risk.