npm Campaign Targets Developers, Steals SSH Keys and Cloud Credentials

Key Takeaways

• A sophisticated supply chain attack campaign targeted developers using malicious npm packages.
• The campaign aimed to steal SSH keys, cloud credentials, cryptocurrency wallet phrases, and API tokens.
• Over 2.7 million downloads were recorded across eleven identified malicious packages, with one package, moralis-sdk, accounting for the majority.
• The attackers utilized various techniques, including npm lifecycle hooks, obfuscated loaders, and Ethereum smart contracts for dynamic command-and-control (C2) infrastructure.
• Evidence suggests a financially motivated actor with Russian language ties is behind the operation.

Widespread npm Supply Chain Attack Compromises Developer Secrets

A new, extensive supply chain attack has been uncovered, posing a significant threat to blockchain developers, Web3 teams, and cloud engineers. This coordinated campaign leveraged multiple malicious packages within the npm registry to surreptitiously exfiltrate sensitive developer secrets upon installation.

The attackers demonstrated a broad scope, targeting a wide array of credentials from SSH private keys and cloud authentication tokens to cryptocurrency wallet phrases and API keys. The sheer scale of the operation is particularly concerning; one central malicious package, moralis-sdk, amassed over 2.7 million downloads before its discovery. This widespread distribution suggests that the malicious code may have infiltrated numerous developer workstations, continuous integration/continuous deployment (CI/CD) pipelines, and cloud environments undetected.

Investigation Uncovers Multi-faceted Campaign

Analysts at Cyfirma initially identified the campaign after detecting two suspicious packages, ethers-jss and coinbase-wallet-utils. Both were designed to mimic legitimate Ethereum development tools. Further investigation linked these to a total of eleven highly suspicious npm packages operating under the same umbrella.

Cyfirma’s research revealed that the packages employed diverse attack methodologies, categorized into four distinct operational clusters. Some packages exploited npm lifecycle hooks to automatically execute malicious code during the installation process. Others utilized obfuscated loaders and even Ethereum smart contracts to dynamically fetch command-and-control (C2) addresses, thereby avoiding hard-coded indicators that could lead to easier detection.

Collectively, these packages recorded more than 2.72 million downloads, marking this as one of the most impactful npm supply chain campaigns observed recently. Alarmingly, active download activity persisted for several packages even after their initial discovery, indicating ongoing victim compromise.

Infection Methods and Exfiltration Techniques

The infection mechanism was straightforward yet effective. Malicious code was embedded within npm lifecycle scripts, specifically preinstall or postinstall hooks. This design ensured that the malicious payload executed automatically the moment a developer initiated an npm install command, requiring no further action from the victim.

The ethers-jss package functioned as a malicious wrapper around the authentic ethers library. Upon installation, it would intercept wallet creation and recovery functions to capture private keys and mnemonic phrases, transmitting them to an attacker-controlled server hosted on GitHub Codespaces. This package also included a Python script, docker_hunter.py, which conducted OSINT-style lookups on Docker Hub repositories associated with blockchain tools.

Conversely, the coinbase-wallet-utils package focused on reconnaissance. It collected the victim’s hostname, username, environment variables, and current working directory, exfiltrating this data covertly using curl. A separate cluster of five packages, published under the npm user ethcompat, employed a more advanced exfiltration method. These packages encrypted stolen credentials using AES-256-GCM and then embedded them within Ethereum blockchain transactions, sending them to an attacker-controlled wallet. This ingenious technique turned the victim’s own blockchain wallet into the exfiltration channel.

The moralis-sdk package demonstrated a particularly sophisticated approach. Initially published in October 2025 as a clean version of the legitimate Moralis SDK, it was later updated to include a heavily obfuscated postinstall.js file. This file utilized a YouTube page as a remote activation switch, only delivering its payload if a specific hidden marker was present, granting the attackers remote control over malware activation.

Blockchain Infrastructure and Attribution Clues

Further innovation was observed in three typosquatting packages: ganach, solidty, and stelar-sdk. Instead of hard-coding C2 server addresses, these packages dynamically queried an Ethereum smart contract to retrieve infrastructure details. The malware then downloaded platform-specific binaries for Windows, Linux, or macOS, adapting to the victim’s operating system.

Researchers also uncovered several clues regarding the attackers’ identity. The npm accounts used to publish the malicious packages featured randomly generated names, a common tactic to hinder attribution. Deobfuscated code contained Russian-language comments and variable names, suggesting a financially motivated actor with prior experience in cryptocurrency-related cybercrime, though no specific group was formally named in the report.

What You Should Do

• Run npm install --ignore-scripts: Always use this flag when installing packages from untrusted or unverified sources to prevent automatic script execution.
• Implement Software Composition Analysis (SCA): Utilize SCA tools to scan your dependencies for known vulnerabilities and malicious packages.
• Avoid Storing Sensitive Information in Plaintext: Never store private keys, seed phrases, or critical credentials in easily accessible plaintext files.
• Rotate Exposed Credentials: Immediately rotate any credentials (SSH keys, API tokens, cloud keys) that may have been exposed through compromised packages.
• Verify Publisher Identity: For Web3 and blockchain development, thoroughly verify the publisher’s identity, download history, and repository ownership before integrating any new npm package into your projects.
• Review Indicators of Compromise (IoCs): Check your systems for any of the following indicators provided by Cyfirma:
  • SHA1: 53b91117db931d3acbbfd15aa8400bb6691e023d (ethers-jss)
  • SHA256: d94a2444268b339dfda2615f7800322fb318e0a484414bb17016cfcd5eb07c44 (ethers-jss)
  • SHA1: 63154cd9c79f9d14eb9be6c4efc2a778d31646ec (coinbase-wallet-utils)
  • SHA256: 6585ca0d3e26c20ced638f46f4a89eea924d411b8753d3fcf434663593c7cf0b (coinbase-wallet-utils)
  • SHA1: 74d3d5ab6d0fa4c6a5860598231728a6a893ecf7 (moralis-sdk v1.0.1)
  • SHA256: 17bad5ae5b2ac262f5f18854853869840245c344105aa38c7f550ef51d2e5f26 (moralis-sdk v1.0.1)
  • SHA1: fcc8a542aad41e758cf6c18571048890be53808e (ganach)
  • SHA256: 7269c00a6164fd01dd516e0a72b2bd84c82e78feb552e06964e4992ff0479dda (ganach)
  • SHA1: 70842cfc27b116d0db2fd7aa33d53a3faf510993 (solidty)
  • SHA256: e848d73a68e4e8aea00a6257552b5872907dfaf7cce3d94636d7e59d286edeab (solidty)
  • SHA1: e1bdcd1a7157f7d047a88ab4573723fe1e861951 (stelar-sdk)
  • SHA256: 2fa5b0475c3b70a3ba14c6a3938baf441a08b11841493b85e087d1d5e01eba49 (stelar-sdk)
  • SHA256: d6abc7003b580472d808b338adef0b28eacc698cd4692f76cb2a91718ab78d88 (hardhat-deploy-utils)
  • SHA256: bab96257018df49ace8fe8adfadc74cf8327fcf9a9dc8a3a7c9ac8e18881df5f (web3-deploy-helper)
  • SHA256: d7ec660a2a29c1aabcbe9bff1ef29be9a9fab8c7fe7c40df4772dd2b5bdf9666 (defi-sdk-core)
  • SHA256: 5c50f79038b31aa8a3a68b24d8b783dfbd2e15fff7586c5609e544a717ef7d05 (ethers-compat)
  • SHA256: feabf10c8a9ba2775bb0f7f9d0b20203112b7df8e6d333a44d5a11eae0e38e86 (ethereum-dev-utils)
  • URL: pastefy.app/RhPBKGli/raw
  • IP:Port: 193[.]233[.]201[.]21:3001
  • Ethereum Smart Contract: 0xa1b40044EBc2794f207D45143Bd82a1B86156c6b
  • Ethereum Wallet Address: 0x52221c293a21D8CA7AFD01Ac6bFAC7175D590A84
  • Ethereum Wallet Address: 0xCBbecC5E5Eb88582e6305cF6ab688f03e02Ce16f

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.