Now Krause is back with a new tool that lets anyone see JavaScript commands injected through an in-app browser.

Security researchers found malware packages using the Ethereum blockchain to conceal malicious commands on GitHub repos.