npm Stealer Reads Its C2 From an Ethereum Contract

Netskope Threat Labs identified and analyzed 28 malicious npm package versions published across four unrelated enterprise namespaces (@servicetitan, @or-sdk, @onereach, and @umacloud) on 2026-08-04. The packages arrived in two rapid bursts: the @or-sdk and @onereach packages at 10:39 UTC, the @servicetitan packages two minutes later at 10:41 UTC, and @umacloud/knowledge nearly three hours after that at 13:18 UTC. All 28 carry an identical or functionally equivalent payload, confirmed by hash match for @umacloud/[email protected], the one tarball still live when we retrieved it. The operator behind the campaign calls it Shai-Hulud, consistent naming with similar attacks we have tracked over the past year [1], [2], [3]. At install time, the packages fetch a signed Bun runtime release from GitHub, execute an obfuscated JavaScript stealer under it, and delete the runtime.

Detonating @or-sdk/[email protected] in the Netskope Advanced Threat Protection sandbox produced the full chain. Measured from the start of npm install to the outbound POST, the payload read SSH private keys, AWS credentials, Docker registry authentication, Jenkins secrets, and /etc/shadow, requested a GitHub CLI token, enumerated AWS Systems Manager Parameter Store and Secrets Manager across 17 regions, queried the EC2 instance metadata service, attempted a HashiCorp Vault AWS login against localhost, and posted an encrypted 4.8 KB bundle to npm-cache.com/router.

That domain is not written into the payload. Deobfuscating the recovered stealer showed that the exfiltration host is resolved at runtime via an eth_call to an Ethereum smart contract, with three public Ethereum RPC providers tried in turn until one responds. The operator can re-point exfiltration to new infrastructure by updating contract state, without republishing a single package. The payload we recovered from @umacloud/[email protected] hashes identically to the sample used against the keyv package family the same day, as reported by Aikido Security, confirming a single campaign toolset. The four namespaces we document here are additional to that reporting.

Key findings

• One payload, four unrelated namespaces, two publishing bursts. The @or-sdk and @onereach packages (12 packages) landed at 10:39 UTC and the 15 @servicetitan packages two minutes later, consistent with separate automated publish pipelines firing in close succession. @umacloud/knowledge arrived nearly three hours after. The payload SHA256 matches the keyv family compromise. The publishing pattern is consistent with multiple stolen organization tokens, worm propagation from a compromised maintainer machine, or theft of GitHub Actions OIDC credentials that can be exchanged for short-lived npm publish tokens scoped to a namespace, which our deobfuscation confirms is one of the payload’s named collection categories. We cannot yet distinguish among vectors.
• The payload ships no binary and hardcodes no C2. The install hook downloads Bun v1.3.13 from the official oven-sh/bun release URL, runs the payload under it, and then deletes the runtime. The exfiltration domain is not in the file either: an eth_call to an Ethereum smart contract returns it at runtime. Detection has to fire on behavior, because there is no malicious executable in the tarball and the executable that does run is legitimately signed.
• The credential sweep is built to maximize yield wherever npm install runs. Developer workstation paths (~/.aws, ~/.ssh, ~/.docker, GitHub CLI tokens) and CI/CD-specific targets (Jenkins secret directories, EC2 IMDS, Vault AWS IAM auth, 17-region Secrets Manager enumeration) are swept in the same pass. The CI/CD paths only pay off on build agents, but the package will run on developer machines too, and the operator collects from both.

IOCs

All publication timestamps are 2026-08-04 UTC, taken from npm registry metadata.

Malicious package versions

Note: burst timestamps are per-namespace group. The @or-sdk and @onereach packages published within two seconds of each other at 10:39, and the @servicetitan packages within one second of each other at 10:41.

Payload

Network

Note on the Ethereum RPC endpoints: these are legitimate public RPC providers that the payload abuses for C2 resolution. Use them for detection and alerting, not for blind blocking.