Six npm Packages Use Ethereum Transactions to Retrieve Malicious Payloads

Author(s): Sonatype Research Team
Organization: sonatype

Open article directly

2026-06-03 ⋅ sonatype ⋅ Sonatype Security Research Team
Lazarus Group's Latest: Brandjacking Campaign on npm

2022-08-11 ⋅ sonatype ⋅ Ax Sharma
PyPI Package 'secretslib' Drops Fileless Linux Malware to Mine Monero

2022-05-20 ⋅ sonatype ⋅ Ax Sharma
New 'pymafka' malicious package drops Cobalt Strike on macOS, Windows, Linux
Cobalt Strike

Propose Change Six npm Packages Use Ethereum Transactions to Retrieve Malicious Payloads