Cybersecurity researchers have discovered two new malicious packages on the npm registry that make use of smart contracts for the Ethereum blockchain to carry out malicious actions on compromised systems, signaling the trend of threat actors constantly on the lookout for new ways to distribute malware and fly under the radar.

"The two npm packages abused smart contracts to conceal malicious commands that installed downloader malware on compromised systems," ReversingLabs researcher Lucija Valentić said in a report shared with The Hacker News.

The packages, both uploaded to npm in July 2025 and no longer available for download, are listed below -

colortoolsv2 (7 downloads)

mimelib2 (1 download)

The software supply chain security firm said the libraries are part of a larger and soph

See Full Page