npm Malicious Packages: Crypto-Wallet Credential Theft Campaign Author: CyberDudeBivash

Powered by: cyberdudebivash.com | cyberbivash.blogspot.com | cryptobivash.code.blog

What happened

Security researchers uncovered four npm packages posing as cryptographic/Flashbots utilities that exfiltrate private keys and seed phrases from developers’ machines (to a Telegram bot) — a coordinated supply-chain attack on Web3 builders. Socket The Hacker News

Packages & publisher

@flashbotts/ethers-provider-bundle
flashbot-sdk-eth
sdk-ethers
gram-utilz
Publisher alias: flashbotts (email aning2028@gmail[.]com). Exfil path includes Telegram bot ID 8083151136 and hard-coded SMTP transport; one package also force-redirects unsigned txs to wallet 0x38F528E7…E3E02. Socket

Note: Similar npm crypto-theft waves have hit recently (e.g., nodejs-smtp, Nx incident), underscoring sustained targeting of developer toolchains. The Hacker News TechRadar

Indicators of Compromise (quick copy)

Installed any of: @flashbotts/ethers-provider-bundle, flashbot-sdk-eth, sdk-ethers, gram-utilz
Outbound traffic to Telegram bot/chat IDs listed above or to smtp.mailtrap.io:2525 during npm install / runtime
Wallet drains or transactions unexpectedly retargeted to 0x38F528E7…E3E02 Socket

What to do now (prioritized)

Immediately remove the four packages from any projects and rotate all exposed secrets (private keys, mnemonics, env vars). Socket
Audit your dependency tree: npm ls | grep -E "(flashbot-sdk-eth|sdk-ethers|ethers-provider-bundle|gram-utilz)".
Lock & verify: enforce lockfiles (npm ci in CI), enable immutable installs, and pin exact versions.
Runtime egress controls in CI/dev: block Telegram/SMTP and unknown domains during builds to catch exfil attempts.
Use supply-chain scanners (e.g., Socket, Snyk) and enable guardrails for AI code assistants to prevent hallucinated package installs. Socket TechRadar
Principle of least privilege for tokens: use scoped, read-only npm/GitHub tokens; store secrets in a vault, not .env files synced to repos.
Hunt for artifacts: search logs for the bot/chat IDs and the Mailtrap host; review git history for added dependencies matching the above names. Socket

One-paragraph summary for your readers

A threat actor published four npm packages — @flashbotts/ethers-provider-bundle, flashbot-sdk-eth, sdk-ethers, gram-utilz — that masquerade as Flashbots/crypto tools but steal wallet secrets to a Telegram bot and can even redirect unsigned transactions to an attacker wallet. Remove them, rotate keys, lock your supply chain, and block egress to Telegram/SMTP during builds. Socket

#CyberDudeBivash #npmSecurity #SoftwareSupplyChain #Web3 #CryptoWallets #MaliciousPackages #Flashbots #OSS #ThreatIntel #CyberDefense

Cyberdudebivash