Supply Chain Warfare: Advanced Typosquatting Targets Web3 Development Ecosystems

Threat actors are increasingly weaponizing the inherent trust placed in open-source dependencies to target Web3 engineering teams. By deploying sophisticated typosquatting campaigns via the npm registry, attackers are transforming routine dependency installations into high-speed conduits for wallet theft, secret harvesting, and multi-stage malware deployment.

This specific campaign is particularly insidious because it leverages the established branding of Ethereum and prominent blockchain utilities. Rather than waiting for manual execution, the malware exploits postinstall and preinstall lifecycle hooks, ensuring malicious code executes automatically the moment a developer runs npm install.

According to a technical report from Cyfirma, researchers identified 11 highly suspicious npm packages designed to impersonate industry-standard tools. These packages mimic legitimate projects such as Ethereum, Coinbase Wallet, Moralis, and Hardhat to deceive even seasoned developers.

The technical objectives of these packages range from reconnaissance and credential theft to remote payload delivery. Most critically, certain variants are engineered to intercept private keys and mnemonic phrases directly from the memory or local storage during wallet creation workflows.

Tactical Execution: Deceptive Wrappers and Trojanized SDKs

The attackers have organized their campaign into distinct tactical clusters:

• Deceptive Wrappers: Packages like ethers-jss and coinbase-wallet-utils act as functional wrappers that include malicious lifecycle hooks to trigger code execution immediately upon installation.
• Trojanized SDKs: The moralis-sdk cluster represents a significantly larger threat. These packages appear to be legitimate copies of the original Moralis SDK, including documentation and source files, but include a hidden, malicious postinstall stage. Given its high profile, this specific variant has seen over 2.7 million downloads, dramatically increasing its potential blast radius.

This operation exploits the “human error” element of development. A developer searching for a specific library may inadvertently install a lookalike package due to a minor typo. To further minimize detection during manual code reviews, the attackers utilize brand impersonation, code obfuscation, and lightweight package structures that blend into a standard project directory.

Advanced Tradecraft and On-Chain C2

The sophistication of this campaign moves beyond simple “dropper” behavior. The malware demonstrates high-maturity tradecraft, including:

• Environment Scraping: Automated harvesting of .env files, SSH keys, environment variables, and Web3-specific configuration files.
• Multi-Stage Payloads: The ability to pull secondary payloads from remote servers once the initial infection is established.
• Blockchain-Assisted C2: In a highly specialized move, the attackers use blockchain-assisted command-and-control (C2) and exfiltration paths, making it incredibly difficult for traditional network monitoring tools to flag the traffic as malicious.

This capability allows attackers to pivot from a single compromised developer workstation to high-value targets, including cloud credentials, CI/CD pipelines, and production-level wallets.

Mitigating the Blast Radius in Web3 Environments

The structural vulnerability in blockchain development lies in the speed of the ecosystem. Web3 teams rely on rapid updates and highly privileged secrets stored in local development environments. When malicious code enters this workflow, the damage is not limited to source code; it extends to private keys, deployment credentials, and direct financial assets.

Anomalies within the packages further highlight the malicious intent. For example, the discovery of docker_hunter.py inside an Ethereum-focused utility package is a significant red flag, as the script has no functional relevance to the package’s stated purpose. Similarly, the use of cloned Moralis SDK files serves only to provide a veneer of authenticity.

For security teams, these findings underscore that dependency auditing, strict lockfile management, package-name verification, and automated secret scanning are no longer optional—they are fundamental pillars of Web3 security architecture.

INDICATORS OF COMPROMISE (IOCs)

Security Advisory: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental execution. Re-fang only within controlled threat intelligence environments.