SlowMist, a blockchain security firm, has identified a large-scale attack campaign distributing JavaScript infostealers through fraudulent repositories impersonating legitimate trading bot and DeFi package projects. The malicious code targets both cryptocurrency users and developers across the DeFi ecosystem.
The infostealer malware is capable of exfiltrating seed phrases, private keys, wallet data, browser cookies, saved passwords, API tokens, and other sensitive authentication credentials from affected systems. The attack vector exploits developers' reliance on open-source package repositories, which poses a significant supply-chain risk across the cryptocurrency industry.
SlowMist disclosed the findings on X (formerly Twitter), highlighting that the campaign's use of counterfeit repositories mimicking popular trading and DeFi tools increases the likelihood of accidental installation by developers unfamiliar with security best practices. The discovery underscores ongoing vulnerabilities in cryptocurrency development infrastructure and the need for enhanced package repository verification protocols.