The package, named nodejs-smtp, impersonates the legitimate email library nodemailer with an identical tagline, page styling, ...

Two npm packages hide downloader commands via Ethereum smart contracts; uploaded July 2025; targeting crypto developers.

Hackers are exploiting Ethereum smart contracts to inject malware into popular NPM coding libraries, using packages to run ...

Unsecured platforms can be susceptible to malicious actors inserting harmful packages to exploit unsuspecting users.

Hackers use Ethereum smart contracts to hide malware in NPM packages, launching a stealthy crypto-themed supply chain attack.