npm Packages Compromised to Fetch Malware from Ethereum Wallet

Six npm packages have been compromised by attackers who used them to query an Ethereum wallet and retrieve malware. The packages, identified by Sonatype Research Labs on August 10, contained the same payload and were tracked as sonatype-2026-005899 and sonatype-2026-005901.

According to Sonatype, the wallet address matches one documented by researchers at OpenSourceMalware, who attributed the activity to the DPRK-linked Contagious Interview campaign associated with the Lazarus group. The loader queried Ethereum for an outbound transaction from the wallet and read bytes out of the transaction's recipient address.

The loader could query several Ethereum remote procedure call providers, including Blockscout API, and batch its calls if one failed. Once resolved, it pulled two further stages from the server, which could either run directly inside the current Node.js process or launch as a detached child process.