Developer News - A sophisticated NPM supply chain attack using Ethereum smart contracts for command-and-control highlights the urgent need for developers to verify package legitimacy and strengthen security practices

https://www.developer-tech.com/news/npm-supply-chain-attack-ethereum-blockchain/

Checkmarx researchers discovered a sophisticated supply chain attack in the NPM ecosystem, where attackers used a malicious package, "jest-fet-mock," to target developers with malware that employs Ethereum smart contracts for command-and-control (C2) operations.

By typosquatting and mimicking popular packages, the attackers lured developers into installing the malware, which can steal information across Windows, Linux, and macOS systems, and maintain persistence using decentralized blockchain infrastructure—making it resilient to removal.

This incident underscores the need for developers to verify package authenticity rigorously and implement stringent security practices to protect their development environments from evolving threats.