- Security researchers from turning labs find two malicious packages on NPM
- These serve as downloaders and target software developers based on Ethereum Blockchain
- Malware opens a reverse shell and gives attackers access to target computers
Two malicious packages were recently discovered on the NPM depot using questionable back doors to target their users.
CyberSecurity scientists from Reversing Labs discovered two packages that were uploaded to the popular depot in early March 2025 called “Ethers-Provider2”, and “Ethers-Providerz” names that were carefully chosen to fool victims to believe that they have something to do with a legitimate package called “Ethers”.
The Ethers pack of NPM is a JavaScript library for interaction with Ethereum Blockchain, which allows developers to send transactions, implement smart contracts and read Blockchain data. It provides a simple and secure API to work with Ethereum cartoons, smart contracts and decentralized applications (DAPPS).
Fake updates
The two malicious packages served as downloaders, “update” the legitimate package and turned it mad.
“These were simple downloaders whose malicious payload was wisely hidden, with another phase that” patches “the legitimate NPM package ether, installed locally, with a new file containing the malicious payload,” the researchers explained. “The patched file ultimately serves a reverse shell.”
With a reverse, forcing the striker victim’s computer to start a connection back to the hacker’s machine, give them the opportunity to run commands, steal data or install malware while successfully bypassing firewalls and similar security measures.
For the researchers at Reversing Labs, the procedure is “very sophisticated”.
Since malware is targeted at the Ethers package, it is safe to assume that the victims here are blockchain developers working on the Ethereum platform. And since malware can act as an infoTealer, it is also safe to assume that the threat actors go to people’s cryptocurrencies.
As usual, the best way to mitigate the threat and protect against these attacks is extra careful when downloading open source packs.
Via Bleeping computer
