Malicious npm Packages Impersonate Flashbots SDKs to Steal Ethereum Wallet Credentials

Socket’s Threat Research Team has uncovered a coordinated supply chain attack targeting the Ethereum ecosystem through four malicious npm packages impersonating Flashbots tooling.

According to the report, researchers identified ethers-provider-bundle, flashbot-sdk-eth, sdk-ethers, and gram-utilz, all published under the npm alias flashbotts with the registration email aning2028@gmail[.]com. These packages were explicitly designed to steal cryptocurrency wallet credentials.

As the team explains: “The packages masquerade as legitimate cryptographic utilities and Flashbots MEV infrastructure while secretly exfiltrating private keys and mnemonic seeds to a Telegram bot controlled by the threat actor.” All four packages used the same Telegram bot ID: 8083151136, confirming the coordinated nature of the campaign.

Flashbots infrastructure, particularly its MEV-Boost middleware, now facilitates “close to 90% of all Ethereum block building”, making it one of the most trusted components in Ethereum’s validator and DeFi ecosystem. This trust made Flashbots an attractive target for impersonation:

“Because Flashbots is widely trusted by validators, searchers, and DeFi developers, any package that appears to be an official SDK has a high chance of being adopted… A compromised private key in this environment can lead to immediate, irreversible theft of funds.”

The four malicious packages implemented different but complementary credential theft mechanisms:

• FlashbotsBundleProvider Variant (@flashbotts/ethers-provider-bundle): Maintains Flashbots API compatibility but secretly harvests environment variables like PRIVATE_KEY_EXECUTOR and PRIVATE_KEY_SPONSOR via SMTP exfiltration, and even redirects unsigned transactions to attacker-controlled addresses.
• sdk-ethers: Disguised as cryptographic utilities, it exfiltrates mnemonic seeds to the Telegram bot when developers generate wallets, returning valid wallet objects to avoid suspicion.
• flashbot-sdk-eth: Targets MEV searchers by automatically stealing private keys upon instantiation of a Flashbot client object.
• gram-utilz: A “utility” package serving as the communication backbone for exfiltration, sending any stolen data directly to the Telegram bot.

The report highlights how well these packages blend in: “Approximately 95% of the package consists of benign functionality to avoid suspicion,” with Vietnamese-language comments in the code suggesting the threat actor may be Vietnamese-speaking.

Socket researchers assess the impact as severe:

“The immediate financial impact centers on private key harvesting, which grants direct access to wallet funds… The packages also implement environment variable theft, specifically targeting PRIVATE_KEY_EXECUTOR and PRIVATE_KEY_SPONSOR variables commonly used in MEV operations.”

A single installation could compromise:

• Trading bot wallets with active positions
• MEV searcher hot wallets
• Development/test wallets with real funds
• Smart contract deployment keys

The packages were still live on npm at the time of reporting, prompting urgent petitions for removal.

Socket warns: “The packages execute silently, leaving no warning until funds are gone. The attacker can monitor incoming credentials and selectively target high-value wallets.”

As Web3 development continues to rely on open-source ecosystems, vigilance against malicious packages — even those masquerading as trusted infrastructure — is more critical than ever.

Related Posts:

• Malicious npm Package Targets TON Wallet Users, Stealing Cryptocurrency Keys
• Malicious Packages Stealing Crypto Credentials: A Warning for Developers
• Darcula Exposed: Inside a Global Phishing-as-a-Service Empire Powered by the Magic Cat Toolkit
• An Ethereum Dev’s Wallet Drained by a Fake AI Extension
• Google Play Store Alert: New Phishing Apps Bypass Security, Stealing Crypto Wallet Seeds