Two npm packages hide downloader commands via Ethereum smart contracts; uploaded July 2025; targeting crypto developers.