CYFIRMA Analyzes 11 Suspicious npm Packages, Including moralis-sdk With 2.7M Downloads

Jun 11, 2026 · Original article ↗

Summary

CYFIRMA analyzed 11 malicious or highly suspicious npm packages targeting Web3 developers; moralis-sdk had over 2.7 million downloads. The report details wallet and credential theft, staged payloads, blockchain-based C2, and on-chain exfiltration.

Key points

Researchers identified 11 malicious or highly suspicious npm packages across four clusters targeting blockchain developers, Web3 projects, and cryptocurrency infrastructure.
The report gives moralis-sdk 2,717,472 downloads and describes its obfuscated post-install downloader; the final-stage payload was unavailable for analysis.
Packages used typosquatting and npm preinstall or postinstall scripts to execute code during installation.
The analyzed packages targeted wallet private keys, mnemonic phrases, SSH keys, cloud credentials, API tokens, and other developer secrets.
Researchers describe Ethereum smart contracts used to retrieve infrastructure and Ethereum transactions used to exfiltrate encrypted credentials.
The report recommends verifying dependencies, restricting lifecycle scripts where feasible, monitoring for credential theft, and rotating potentially exposed secrets.

Article Details

Attack Vectors: Malicious and typosquatted npm packages impersonated blockchain development libraries and used preinstall or postinstall lifecycle hooks to execute code during installation.
The ethers-jss package intercepted wallet creation and recovery functions to capture private keys and mnemonic phrases, and searched environment variables, configuration files, and SSH directories for credentials.
The coinbase-wallet-utils package collected host and environment information and sent it to an external C2 endpoint.
The moralis-sdk package used a remote activation check and a multi-stage PowerShell downloader to retrieve and execute payloads, including a batch file hosted on remote services.
Ganach, Solidty, and Stelar-sdk used Ethereum smart-contract lookups to retrieve infrastructure and download platform-specific payloads.
Five packages published by the npm user ethcompat harvested cryptocurrency credentials and exfiltrated encrypted data in Ethereum transactions to an attacker-controlled wallet.
Defensive Notes: Verify package authenticity, maintainers, publication history, and repository ownership before installation; monitor for typosquatting and unexpected package updates.
Disable npm lifecycle scripts where feasible, or use npm install --ignore-scripts; monitor preinstall and postinstall activity.
Keep private keys, seed phrases, API tokens, and cloud credentials out of plaintext files; use dedicated secrets management and rotate credentials after suspected exposure.
Apply least privilege to developer workstations and CI/CD environments, and monitor access to SSH keys, sensitive configuration files, and deployment secrets.
Inspect outbound traffic for unauthorized communications to external infrastructure and monitor for credential collection and exfiltration, including blockchain transactions.
Remove malicious packages from affected environments and review repositories, CI/CD pipelines, and infrastructure logs for post-compromise activity.

Indicators of compromise

Type	Indicator	Context
SHA1	`53b91117db931d3acbbfd15aa8400bb6691e023d`	SHA1 of the ethers-jss package archive identified in the campaign.
SHA1	`63154cd9c79f9d14eb9be6c4efc2a778d31646ec`	SHA1 of the coinbase-wallet-utils package archive identified in the campaign.
SHA1	`70842cfc27b116d0db2fd7aa33d53a3faf510993`	SHA1 of the Solidty package archive identified in the campaign.
SHA1	`74d3d5ab6d0fa4c6a5860598231728a6a893ecf7`	SHA1 of the malicious moralis-sdk v1.0.1 package archive.
SHA1	`e1bdcd1a7157f7d047a88ab4573723fe1e861951`	SHA1 of the Stelar-sdk package archive identified in the campaign.
SHA1	`fcc8a542aad41e758cf6c18571048890be53808e`	SHA1 of the Ganach package archive identified in the campaign.
SHA256	`17bad5ae5b2ac262f5f18854853869840245c344105aa38c7f550ef51d2e5f26`	SHA256 of the malicious moralis-sdk v1.0.1 package archive.
SHA256	`2fa5b0475c3b70a3ba14c6a3938baf441a08b11841493b85e087d1d5e01eba49`	SHA256 of the Stelar-sdk package archive identified in the campaign.
SHA256	`5c50f79038b31aa8a3a68b24d8b783dfbd2e15fff7586c5609e544a717ef7d05`	SHA256 of the ethers-compat package archive identified in the campaign.
SHA256	`6585ca0d3e26c20ced638f46f4a89eea924d411b8753d3fcf434663593c7cf0b`	SHA256 of the coinbase-wallet-utils package archive identified in the campaign.
SHA256	`7269c00a6164fd01dd516e0a72b2bd84c82e78feb552e06964e4992ff0479dda`	SHA256 of the Ganach package archive identified in the campaign.
SHA256	`bab96257018df49ace8fe8adfadc74cf8327fcf9a9dc8a3a7c9ac8e18881df5f`	SHA256 of the web3-deploy-helper package archive identified in the campaign.
SHA256	`d6abc7003b580472d808b338adef0b28eacc698cd4692f76cb2a91718ab78d88`	SHA256 of the hardhat-deploy-utils package archive identified in the campaign.
SHA256	`d7ec660a2a29c1aabcbe9bff1ef29be9a9fab8c7fe7c40df4772dd2b5bdf9666`	SHA256 of the defi-sdk-core package archive identified in the campaign.
SHA256	`d94a2444268b339dfda2615f7800322fb318e0a484414bb17016cfcd5eb07c44`	SHA256 of the ethers-jss package archive identified in the campaign.
SHA256	`e848d73a68e4e8aea00a6257552b5872907dfaf7cce3d94636d7e59d286edeab`	SHA256 of the Solidty package archive identified in the campaign.
SHA256	`feabf10c8a9ba2775bb0f7f9d0b20203112b7df8e6d333a44d5a11eae0e38e86`	SHA256 of the ethereum-dev-utils package archive identified in the campaign.
URL	`hxxp[:]//193[.]233[.]201[.]21:3001`	C2 and remote payload-distribution endpoint resolved through the malware's blockchain-based infrastructure lookup.
URL	`hxxps[:]//pastefy[.]app/RhPBKGli/raw`	Specific Pastefy resource identified as hosting a Base64-encoded PowerShell payload in the moralis-sdk infection chain.