Ethereum smart contracts used to push malicious code on npm

The title seems to be a bit misleading:

What is new and different is the use of Ethereum smart contracts to host the URLs where malicious commands are located downloading the second stage malware.