Hackers Use Typosquatted npm Packages to Target Web3 Projects and Crypto Wallet Operators

Hackers have been using typosquatting npm packages to weaponize the trust Web3 teams place in open-source dependencies, turning routine installs into a path for wallet theft, secret harvesting, and staged malware delivery.

The campaign is especially dangerous because it blends familiar Ethereum and blockchain branding with postinstall and preinstall abuse, allowing malicious code to execute automatically during installation rather than waiting for a user to run it manually.

The report describes 11 suspicious npm packages that impersonate legitimate blockchain tools and utilities, including names built to resemble Ethereum, Coinbase Wallet, Moralis, Hardhat, and other Web3 projects.

Researchers found that the packages were designed for credential theft, reconnaissance, remote payload delivery, and wallet interception, with some variants capturing private keys and mnemonic phrases directly from wallet creation flows.

One cluster focused on deceptive wrappers such as ethers-jss and coinbase-wallet-utils, which abused lifecycle hooks to run code immediately after installation.

Another cluster centered on moralis-sdk, a trojanized package that copied legitimate project files and documentation but added a malicious postinstall stage; the package had more than 2.7 million downloads, making its exposure far larger than the rest of the campaign.

This operation works because typosquatting exploits small human errors: a developer searching for a library may install a lookalike package before noticing the misspelling.

The attackers also used brand impersonation, obfuscation, and lightweight package structures to make the malware look routine and to reduce suspicion during code review.

The technical tradecraft is more mature than a simple dropper campaign. The report notes credential harvesting from environment variables, .env files, SSH keys, and Web3 configuration files, plus multi-stage payload delivery and even blockchain-assisted command-and-control and exfiltration paths.

Cyfirma said in a report shared with GBhackers, a cryptocurrency-focused software supply chain campaign involving multiple malicious npm packages targeting blockchain developers, Web3 projects.

That matters because it lets attackers move from a single compromised workstation to cloud credentials, CI/CD systems, and production wallets.

Typosquatted npm Packages

This case highlights a structural weakness in blockchain development: Web3 projects often depend on fast-moving open-source packages, frequent updates, and highly privileged secrets stored in developer environments.

At the time of analysis, coinbase-wallet-utils recorded approximately 63 weekly downloads, which increased to 66 weekly downloads during subsequent monitoring.

When malicious code lands in that workflow, the blast radius can include private keys, deployment credentials, and direct financial assets rather than just source code.

The most worrying detail is that the attackers did not rely on one technique. They combined typosquatting, lifecycle hook abuse, obfuscated loaders, remote payload retrieval, and on-chain exfiltration to make detection harder and cleanup more difficult. In other words, this is supply-chain compromise tuned specifically for crypto infrastructure.

The inclusion of a Python script named docker_hunter.py inside a supposedly Ethereum utility-focused npm package is highly suspicious and inconsistent with the package’s claimed functionality. 

Analysis of the remaining package contents indicates they are largely identical to the legitimate Moralis SDK source code, examples, and supporting files, suggesting they were copied from the original Moralis project to create the appearance of authenticity. 

The article’s findings align with a wider pattern of open-source abuse where attackers prefer package repositories over exploit chains because package trust is already built into developer behavior.

For teams running Web3 applications, this means dependency auditing, package-name verification, lockfile control, and secret scanning are not optional hygiene measures; they are core security controls.

A practical example is a developer installing what looks like a wallet helper library, only to trigger a postinstall script that silently exfiltrates mnemonic phrases and .env contents before deployment.

That is why even small packages with low download counts can be highly dangerous when they target sensitive build environments.

INDICATORS OF COMPROMISE

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.