{"id":13590,"date":"2026-06-13T10:03:58","date_gmt":"2026-06-13T10:03:58","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/06\/13\/malicious-npm-campaign-steals-ssh-keys-api-tokens-cloud-credentials-and-wallet-secrets\/"},"modified":"2026-06-13T10:03:58","modified_gmt":"2026-06-13T10:03:58","slug":"malicious-npm-campaign-steals-ssh-keys-api-tokens-cloud-credentials-and-wallet-secrets","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/06\/13\/malicious-npm-campaign-steals-ssh-keys-api-tokens-cloud-credentials-and-wallet-secrets\/","title":{"rendered":"Malicious npm Campaign Steals SSH Keys, API Tokens, Cloud Credentials, and Wallet Secrets"},"content":{"rendered":"

Malicious npm Campaign Steals SSH Keys, API Tokens, Cloud Credentials, and Wallet Secrets
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A fresh wave of supply chain attacks is putting blockchain developers, Web3 teams, and cloud engineers at serious risk. <\/p>\n

Researchers have uncovered a coordinated campaign involving multiple malicious packages on the npm registry, each designed to quietly steal sensitive secrets the moment a developer installs them. <\/p>\n

From SSH private keys to cloud credentials, wallet phrases to API tokens, this campaign leaves almost no secret untouched.<\/p>\n

What makes this effort particularly alarming is its scale. One package at the center of the investigation, moralis-sdk, had accumulated more than 2.7 million downloads by the time researchers flagged it. <\/p>\n

That reach means the malicious code may have already touched thousands of developer workstations<\/a>, CI\/CD pipelines, and cloud environments without anyone realizing it.<\/p>\n

Analysts at\u00a0Cyfirma\u00a0identified the campaign after spotting two suspicious packages, ethers-jss and coinbase-wallet-utils, both built to impersonate legitimate Ethereum development tools. <\/p>\n

Through deeper investigation, they linked eleven highly suspicious npm packages to the same operation, as the researchers at Cyfirma said in a report<\/a> shared with Cyber Security News (CSN).<\/p>\n

The packages were not all built the same way. Cyfirma\u2019s research revealed four distinct operational clusters, each targeting developers through a different method. <\/p>\n

\n
\"System
System Reconnaissance & Data Exfiltration (Source \u2013 Cyfirma)<\/figcaption><\/figure>\n<\/div>\n

Some abused npm lifecycle hooks to auto-execute malicious code during install, while others relied on obfuscated loaders and Ethereum smart contracts to retrieve command-and-control addresses without hard-coding anything obvious.<\/p>\n

Together, these packages recorded more than 2.72 million combined downloads, making this one of the more impactful npm supply chain campaigns seen recently. <\/p>\n

Active download activity during the investigation confirmed that several packages were still reaching new victims even after discovery.<\/p>\n

Malicious npm Campaign<\/strong><\/h2>\n

The infection method was deceptively simple. Each package used npm lifecycle scripts, either preinstall or postinstall hooks, to trigger malicious code the moment a developer ran an install command. No extra steps were needed on the victim\u2019s side.<\/p>\n

The ethers-jss package acted as a malicious wrapper around the real ethers library. Once installed, it intercepted wallet creation and recovery functions to capture private keys and mnemonic phrases, sending them to an attacker-controlled server on GitHub Codespaces. <\/p>\n

It also included a Python script named docker_hunter.py<\/a>, which performed OSINT-style lookups on Docker Hub repositories tied to blockchain tools.<\/p>\n

\n
\"Command-and-Control
Command-and-Control (C2) Configuration (Source \u2013 Cyfirma)<\/figcaption><\/figure>\n<\/div>\n

The coinbase-wallet-utils package focused on reconnaissance, collecting the victim\u2019s hostname, username, environment variables, and working directory, then exfiltrating everything silently using curl. <\/p>\n

A separate cluster of five packages published by the npm user ethcompat went further, encrypting stolen credentials with AES-256-GCM and embedding them inside Ethereum blockchain transactions sent to an attacker-controlled wallet, turning the victim\u2019s own wallet into the exfiltration channel.<\/p>\n

The moralis-sdk package was particularly crafty. It started as a clean copy of the legitimate Moralis SDK in October 2025, then was weaponized through an update that added a heavily obfuscated postinstall.js file. <\/p>\n

That file used a YouTube page as a remote activation switch and only delivered its payload if a hidden marker was found, giving the attacker remote control over when the malware activated.<\/p>\n

Blockchain Infrastructure and Attribution Clues<\/strong><\/h2>\n

Three typosquatting packages, ganach, solidty, and stelar-sdk, added another layer of innovation. Instead of hard-coding a server address, these packages queried an Ethereum smart contract to retrieve infrastructure details dynamically. <\/p>\n

The malware then downloaded platform-specific binaries for Windows, Linux, or macOS depending on the victim\u2019s system.<\/p>\n

Researchers also found several attribution hints. The accounts used to publish the packages had randomly generated names, a common tactic to avoid being traced. <\/p>\n

Deobfuscated code contained Russian-language comments and variable names, pointing to a financially motivated actor with experience in cryptocurrency-related cybercrime, though no specific group was formally named.<\/p>\n

\n
\"Cryptocurrency
Cryptocurrency Wallet Hijacking Logic (Source \u2013 Cyfirma)<\/figcaption><\/figure>\n<\/div>\n

Cyfirma recommends running installs with the flag npm install \u2013ignore-scripts to block automatic script execution. <\/p>\n

Organizations should also deploy Software Composition Analysis tools<\/a>, avoid storing private keys or seed phrases in plaintext, and rotate any exposed credentials immediately. <\/p>\n

Developers in Web3 environments should verify publisher identity, download history, and repository ownership before adding any unfamiliar package to their project.<\/p>\n

Indicators of Compromise (IoCs):-<\/strong><\/h2>\n
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
#<\/th>\nType<\/th>\nIndicator<\/th>\nDescription<\/th>\n<\/tr>\n<\/thead>\n
1<\/td>\nSHA1<\/td>\n53b91117db931d3acbbfd15aa8400bb6691e023d<\/td>\nethers-jss package archive<\/td>\n<\/tr>\n
2<\/td>\nSHA256<\/td>\nd94a2444268b339dfda2615f7800322fb318e0a484414bb17016cfcd5eb07c44<\/td>\nethers-jss package archive<\/td>\n<\/tr>\n
3<\/td>\nSHA1<\/td>\n63154cd9c79f9d14eb9be6c4efc2a778d31646ec<\/td>\ncoinbase-wallet-utils package archive<\/td>\n<\/tr>\n
4<\/td>\nSHA256<\/td>\n6585ca0d3e26c20ced638f46f4a89eea924d411b8753d3fcf434663593c7cf0b<\/td>\ncoinbase-wallet-utils package archive<\/td>\n<\/tr>\n
5<\/td>\nSHA1<\/td>\n74d3d5ab6d0fa4c6a5860598231728a6a893ecf7<\/td>\nmoralis-sdk v1.0.1 package archive<\/td>\n<\/tr>\n
6<\/td>\nSHA256<\/td>\n17bad5ae5b2ac262f5f18854853869840245c344105aa38c7f550ef51d2e5f26<\/td>\nmoralis-sdk v1.0.1 package archive<\/td>\n<\/tr>\n
7<\/td>\nSHA1<\/td>\nfcc8a542aad41e758cf6c18571048890be53808e<\/td>\nganach package archive<\/td>\n<\/tr>\n
8<\/td>\nSHA256<\/td>\n7269c00a6164fd01dd516e0a72b2bd84c82e78feb552e06964e4992ff0479dda<\/td>\nganach package archive<\/td>\n<\/tr>\n
9<\/td>\nSHA1<\/td>\n70842cfc27b116d0db2fd7aa33d53a3faf510993<\/td>\nsolidty package archive<\/td>\n<\/tr>\n
10<\/td>\nSHA256<\/td>\ne848d73a68e4e8aea00a6257552b5872907dfaf7cce3d94636d7e59d286edeab<\/td>\nsolidty package archive<\/td>\n<\/tr>\n
11<\/td>\nSHA1<\/td>\ne1bdcd1a7157f7d047a88ab4573723fe1e861951<\/td>\nstelar-sdk package archive<\/td>\n<\/tr>\n
12<\/td>\nSHA256<\/td>\n2fa5b0475c3b70a3ba14c6a3938baf441a08b11841493b85e087d1d5e01eba49<\/td>\nstelar-sdk package archive<\/td>\n<\/tr>\n
13<\/td>\nSHA256<\/td>\nd6abc7003b580472d808b338adef0b28eacc698cd4692f76cb2a91718ab78d88<\/td>\nhardhat-deploy-utils package archive<\/td>\n<\/tr>\n
14<\/td>\nSHA256<\/td>\nbab96257018df49ace8fe8adfadc74cf8327fcf9a9dc8a3a7c9ac8e18881df5f<\/td>\nweb3-deploy-helper package archive<\/td>\n<\/tr>\n
15<\/td>\nSHA256<\/td>\nd7ec660a2a29c1aabcbe9bff1ef29be9a9fab8c7fe7c40df4772dd2b5bdf9666<\/td>\ndefi-sdk-core package archive<\/td>\n<\/tr>\n
16<\/td>\nSHA256<\/td>\n5c50f79038b31aa8a3a68b24d8b783dfbd2e15fff7586c5609e544a717ef7d05<\/td>\nethers-compat package archive<\/td>\n<\/tr>\n
17<\/td>\nSHA256<\/td>\nfeabf10c8a9ba2775bb0f7f9d0b20203112b7df8e6d333a44d5a11eae0e38e86<\/td>\nethereum-dev-utils package archive<\/td>\n<\/tr>\n
18<\/td>\nURL<\/td>\npastefy.app\/RhPBKGli\/raw<\/td>\nBase64-encoded PowerShell payload hosting location<\/td>\n<\/tr>\n
19<\/td>\nIP:Port<\/td>\n193[.]233[.]201[.]21:3001<\/td>\nRemote payload distribution server retrieved via blockchain mechanism<\/td>\n<\/tr>\n
20<\/td>\nEthereum Smart Contract<\/td>\n0xa1b40044EBc2794f207D45143Bd82a1B86156c6b<\/td>\nUsed by malware to retrieve dynamic infrastructure information<\/td>\n<\/tr>\n
21<\/td>\nEthereum Wallet Address<\/td>\n0x52221c293a21D8CA7AFD01Ac6bFAC7175D590A84<\/td>\nQueried by the smart contract lookup mechanism to obtain C2 configuration<\/td>\n<\/tr>\n
22<\/td>\nEthereum Wallet Address<\/td>\n0xCBbecC5E5Eb88582e6305cF6ab688f03e02Ce16f<\/td>\nAttacker-controlled wallet used to receive exfiltrated credential transactions<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

Note:<\/strong>\u00a0IP addresses and domains are intentionally defanged (e.g.,\u00a0<\/em>[.]<\/em><\/code>) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM<\/em>.<\/p>\n

Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates<\/strong>,\u00a0Set CSN as a Preferred Source in<\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong> Google<\/a><\/strong><\/strong>.<\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/p>\n

The post Malicious npm Campaign Steals SSH Keys, API Tokens, Cloud Credentials, and Wallet Secrets<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

Malicious npm Campaign Steals SSH Keys, API Tokens, Cloud Credentials, and Wallet Secrets A fresh wave of supply chain attacks is putting blockchain developers, Web3 teams, and cloud engineers at serious risk. Researchers have uncovered a coordinated campaign involving multiple malicious packages on the npm registry, each designed to quietly steal sensitive secrets the moment […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-13590","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/13590"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=13590"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/13590\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=13590"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=13590"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=13590"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}