Malicious npm Campaign Steals SSH Keys, API Tokens, Cloud Credentials, and Wallet Secrets

A fresh wave of supply chain attacks is putting blockchain developers, Web3 teams, and cloud engineers at serious risk.

Researchers have uncovered a coordinated campaign involving multiple malicious packages on the npm registry, each designed to quietly steal sensitive secrets the moment a developer installs them.

From SSH private keys to cloud credentials, wallet phrases to API tokens, this campaign leaves almost no secret untouched.

What makes this effort particularly alarming is its scale. One package at the center of the investigation, moralis-sdk, had accumulated more than 2.7 million downloads by the time researchers flagged it.

That reach means the malicious code may have already touched thousands of developer workstations, CI/CD pipelines, and cloud environments without anyone realizing it.

Analysts at Cyfirma identified the campaign after spotting two suspicious packages, ethers-jss and coinbase-wallet-utils, both built to impersonate legitimate Ethereum development tools.

Through deeper investigation, they linked eleven highly suspicious npm packages to the same operation, as the researchers at Cyfirma said in a report shared with Cyber Security News (CSN).

The packages were not all built the same way. Cyfirma’s research revealed four distinct operational clusters, each targeting developers through a different method.

Some abused npm lifecycle hooks to auto-execute malicious code during install, while others relied on obfuscated loaders and Ethereum smart contracts to retrieve command-and-control addresses without hard-coding anything obvious.

Together, these packages recorded more than 2.72 million combined downloads, making this one of the more impactful npm supply chain campaigns seen recently.

Active download activity during the investigation confirmed that several packages were still reaching new victims even after discovery.

Malicious npm Campaign

The infection method was deceptively simple. Each package used npm lifecycle scripts, either preinstall or postinstall hooks, to trigger malicious code the moment a developer ran an install command. No extra steps were needed on the victim’s side.

The ethers-jss package acted as a malicious wrapper around the real ethers library. Once installed, it intercepted wallet creation and recovery functions to capture private keys and mnemonic phrases, sending them to an attacker-controlled server on GitHub Codespaces.

It also included a Python script named docker_hunter.py, which performed OSINT-style lookups on Docker Hub repositories tied to blockchain tools.

The coinbase-wallet-utils package focused on reconnaissance, collecting the victim’s hostname, username, environment variables, and working directory, then exfiltrating everything silently using curl.

A separate cluster of five packages published by the npm user ethcompat went further, encrypting stolen credentials with AES-256-GCM and embedding them inside Ethereum blockchain transactions sent to an attacker-controlled wallet, turning the victim’s own wallet into the exfiltration channel.

The moralis-sdk package was particularly crafty. It started as a clean copy of the legitimate Moralis SDK in October 2025, then was weaponized through an update that added a heavily obfuscated postinstall.js file.

That file used a YouTube page as a remote activation switch and only delivered its payload if a hidden marker was found, giving the attacker remote control over when the malware activated.

Blockchain Infrastructure and Attribution Clues

Three typosquatting packages, ganach, solidty, and stelar-sdk, added another layer of innovation. Instead of hard-coding a server address, these packages queried an Ethereum smart contract to retrieve infrastructure details dynamically.

The malware then downloaded platform-specific binaries for Windows, Linux, or macOS depending on the victim’s system.

Researchers also found several attribution hints. The accounts used to publish the packages had randomly generated names, a common tactic to avoid being traced.

Deobfuscated code contained Russian-language comments and variable names, pointing to a financially motivated actor with experience in cryptocurrency-related cybercrime, though no specific group was formally named.

Cyfirma recommends running installs with the flag npm install –ignore-scripts to block automatic script execution.

Organizations should also deploy Software Composition Analysis tools, avoid storing private keys or seed phrases in plaintext, and rotate any exposed credentials immediately.

Developers in Web3 environments should verify publisher identity, download history, and repository ownership before adding any unfamiliar package to their project.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.