Sophisticated npm Supply Chain Attack Targets Blockchain Developers A newly uncovered software supply chain attack has compromised blockchain developers through eleven malicious npm packages, designed to steal cryptocurrency wallet credentials and infiltrate development environments. Discovered by Cyfirma Research, the campaign exploited open-source ecosystems to target Web3 projects and cloud-native infrastructure, amassing over 2.7 million downloads and significantly expanding its reach. The attack employed typosquatting and impersonation tactics, tricking developers into installing packages that mimicked legitimate tools. Three distinct clusters of malicious packages were identified: 1. Coinbase Wallet Utils – Functioned as an information stealer, conducting host reconnaissance and exfiltrating sensitive data to attacker-controlled servers. 2. moralis-sdk – The most downloaded package, containing an obfuscated post-install script that initiated a multi-stage infection chain, downloading and executing remote payloads. 3. Typosquatted packages (e.g., Ganach, Solidity, Stelar-sdk) – Leveraged blockchain-based command-and-control infrastructure to dynamically deploy platform-specific malware. Additionally, an npm user named ethcompat published five malicious packages, including hardhat-deploy-utils and ethers-compat, which harvested deployment credentials, SSH keys, and wallet secrets collectively garnering over 2,200 downloads. The primary attack vector relied on npm post-installation scripts, which executed malicious code automatically upon package installation, requiring no further user interaction. The campaign underscores the growing threat of supply chain attacks in open-source ecosystems, particularly against cryptocurrency and decentralized finance (DeFi) projects. Indicators of compromise (IoCs) include SHA1/SHA256 hashes for malicious packages such as ethers-jss and coinbase-wallet-utils, though attacker-controlled domains and IPs remain defanged to prevent accidental resolution.