Russian Cybercriminals Target Ethereum Developers with Phony Hardhat npm Packages

Cybersecurity experts have uncovered some sneaky stuff going on in the npm registry. Turns out, there are some bad actors out there pretending to be the Nomic Foundation’s Hardhat tool, all so they can steal important info from developers like you.

These impostor packages are getting cozy with open source plugins, tricking their way into your systems, and snatching up private keys, mnemonics, and other confidential data. Not cool, right? The Socket research team dug into this and found out that Hardhat, a nifty tool for Ethereum software developers, is the target of these shady dealings.

Here’s a rundown of some of the fake packages floating around out there:

– nomicsfoundations
– @nomisfoundation/hardhat-configure
– installedpackagepublish
– @nomisfoundation/hardhat-config
– @monicfoundation/hardhat-config
– @nomicsfoundation/sdk-test
– and more

One of these impostor packages, @nomicsfoundation/sdk-test, has already been downloaded a whopping 1,092 times since it was sneakily published in October 2023. Once installed, these bogus packages start snooping around, trying to snag sensitive info like your private keys and mnemonic phrases. And you guessed it, they then send all that juicy data straight to the hackers.

The folks behind this nefarious scheme are taking advantage of the functions in the Hardhat runtime environment to pull off their heist. They use tricks like hreInit() and hreConfig() to grab your private keys, mnemonics, and configuration files, and then ship them off to their own servers. Sneaky, sneaky.

And this is just the tip of the iceberg. There’s also been talk of another fishy npm package called ethereumvulncontracthandler that’s up to no good. It pretends to be a tool for sniffing out vulnerabilities in Ethereum smart contracts, but it’s really just a cover for dropping some malware on your system. Yikes!

These bad actors are not only messing around with npm packages but also dabbling in Ethereum smart contracts to build botnets and run other shady operations. It’s a real mess out there.

So, what can you do to protect yourself? Well, first and foremost, be cautious about what packages you install. Make sure to double-check their authenticity and take a close look at the source code before hitting that install button. Stay safe out there, folks!