npm Nightmares: Ethers Library Hijacked for Reverse Shell Chaos

Direct Answer

Key Points:
It seems likely that two malicious npm packages, ethers-provide2 and ethers-providez, were found modifying the local ethers library to set up a reverse shell, with ethers-provide2 downloaded 73 times. Research suggests this attack persists even after uninstalling the packages, posing a risk to developers. The evidence leans toward this being a supply chain attack, emphasizing the need for careful package scrutiny.

Overview

On March 15, 2025, security researchers identified two malicious npm packages targeting the ethers library, a popular tool for Ethereum development. These packages, ethers-provide2 and ethers-providez, were designed to modify local installations, adding files that enable a reverse shell connecting to an attacker’s server.

How It Works

The attack begins when developers install these packages, which then execute scripts to alter the ethers library. A malicious file is added, setting up a reverse shell that persists even if the packages are uninstalled, potentially reinfecting the system upon reinstalling ethers.

Implications

This attack highlights risks for red teamers simulating such threats, blue teamers detecting file changes, SOC teams analyzing logs, incident responders containing breaches, and enterprises securing their development pipelines. It’s a reminder of the dangers in open-source ecosystems, especially for blockchain projects where financial losses could occur.

Unexpected Detail

Interestingly, while ethers-providez had no downloads and was likely removed by its creator, ethers-provide2 still managed 73 downloads, showing how even low-download packages can pose significant risks.

Survey Note

Introduction

On March 26, 2025, a significant software supply chain attack was reported, involving two malicious npm packages, ethers-provide2 and ethers-providez, targeting the ethers library, a critical component for Ethereum and blockchain development. This attack, detailed in a recent article on The Hacker News, underscores the ongoing risks in open-source ecosystems and has implications for red team, blue team, SOC, incident response, and enterprise security professionals. This survey note explores the attack’s mechanics, its impact, and best practices to mitigate such threats, drawing from the provided article and additional web research.

Background and Context

The ethers library, with over 138 million downloads as noted on npm, is essential for dapps, wallets, and other Ethereum-related tools. Its popularity makes it a prime target for attackers. The malicious packages, published on March 15, 2025, were identified as ethers-provide2 (downloaded 73 times) and ethers-providez (no downloads, likely removed by the creator). This attack aligns with a trend of npm supply chain attacks, as seen in recent reports like Phylum’s analysis of similar Ethereum-targeting packages.

Attack Mechanics

The attack operates in multiple stages:

Installation Phase: Developers inadvertently install ethers-provide2 or ethers-providez, possibly through typosquatting or social engineering.
Payload Execution: These packages act as downloaders, executing scripts during installation that modify the local ethers package.
File Modification: A malicious file is added to the ethers package directory, enabling a reverse shell. This is consistent with findings from Snyk’s blog, which discuss how npm packages can overwrite local files.
Persistence Mechanism: The modification persists even after uninstalling the malicious packages, meaning reinfection can occur if the ethers package is reinstalled. This persistence is achieved by altering the local installation, not the official ethers package, which remains uncompromised.
Command and Control: The reverse shell connects to a remote server controlled by the attacker, potentially allowing unauthorized access and data exfiltration.

This multi-stage approach is sophisticated, leveraging the trust in open-source repositories like npm, which hosts over 1.5 million packages, as noted in Snyk’s research.

Implications for Security Roles

Red Teamers

For red teamers, this attack offers a playbook for simulating supply chain attacks. They can create similar malicious packages to test organizational defenses, focusing on tactics like typosquatting and postinstall script exploitation. This aligns with strategies discussed in Duo’s Decipher blog, which details how attackers modify local packages.

Blue Teamers

Blue teamers must focus on detecting unusual file modifications in the node_modules directory, particularly for critical libraries like ethers. Behavioral analysis, such as monitoring for unexpected network connections or processes, is crucial. Tools like ReversingLabs Spectra Assure can help identify suspicious package behavior.

SOC and Incident Response

SOC teams should analyze installation logs for anomalies, such as scripts executed during npm install, and look for indicators of compromise like reverse shell connections. Incident responders need to isolate affected systems, remove the malicious file from the ethers package, and investigate data exfiltration, as highlighted in Black Duck’s blog on npm security.

Enterprise Security

For enterprises, this attack underscores the need for secure development practices. Implementing centralized package management with vetting, using tools like JFrog’s security research, and conducting regular dependency audits can mitigate risks. Given ethers’ role in financial applications, breaches could lead to significant losses, as seen in recent Ethereum-related attacks reported on Bleeping Computer.

Statistical Overview

The following table summarizes key metrics of the attack:

Package Name	Downloads	Status	Published Date
ethers-provide2	73	Active at time of report	March 15, 2025
ethers-providez	0	Likely removed by creator	March 15, 2025

This table, derived from the article summary, highlights the limited but potentially impactful reach of ethers-provide2.

Preventive Measures

To mitigate such attacks, the following best practices are recommended:

Verify Package Sources: Only install from trusted sources and check package reputations on platforms like npm.
Use Security-Enhanced Package Managers: Leverage managers with scanning capabilities, as suggested in Snyk’s blog.
Regular Dependency Audits: Keep dependencies updated and remove unnecessary packages, aligning with ReversingLabs’ advice.
Educate Developers: Train teams to recognize risks, such as postinstall scripts, as discussed in Security Stack Exchange.

Discussion and Future Outlook

This attack is part of a broader trend of npm ecosystem compromises, with recent reports like The Hacker News noting North Korean campaigns using similar tactics. The persistence mechanism, where local modifications survive uninstallation, is particularly concerning, as it could evade standard cleanup procedures. Future research should focus on automated detection of such modifications and enhancing npm’s security features.

An X post from TheCySecNews on March 26, 2025, corroborates this, mentioning the malicious package modifying the ethers library for a reverse shell, reinforcing the urgency of these findings.

Conclusion

The ethers-provide2 and ethers-providez attack is a stark reminder of supply chain vulnerabilities in open-source ecosystems. By understanding its mechanics and implications, security professionals can better protect their organizations, ensuring robust defenses against evolving threats.