Two new malicious npm packages exploit Ethereum smart contracts to target crypto developers.