NullReceiver trojanized npm packages C2 via Ethereum recipient address
Malware Activity
Summary
Hide ▲
Show ▼
NullReceiver is a malware activity that hides C2 infrastructure inside Ethereum recipient addresses, letting trojanized npm packages decode a server location from a blockchain transfer instead of using a smart contract or calldata. In the broader activity, bianira-ui and fluid-type-ui were published on July 28, 2026 and later removed from npm after limited downloads, while researchers tied the technique to the DPRK-linked Contagious Interview campaign associated with the Lazarus group. New reporting adds six npm packages identified by Sonatype Research Labs on August 10, all carrying the same payload and tracked as sonatype-2026-005899 and sonatype-2026-005901. Sonatype said the loader queried an attacker-controlled Ethereum wallet to recover C2 addresses, and the six packages split between three hijacked publishing accounts and three purpose-built packages.
Related Happenings
AsyncAPI repositories and npm publishing workflow hit by network compromise
Incident
H score27
First: 15.07.2026 12:16
Last: 15.07.2026 12:16
Sources 1
About this happening:
The AsyncAPI npm publishing pipeline was compromised in a July 14 supply-chain attack that used the project’s normal GitHub Actions release path to publish trojani...
AsyncAPI repositories and npm publishing workflow hit by network compromise
IncidentAbout this happening: The AsyncAPI npm publishing pipeline was compromised in a July 14 supply-chain attack that used the project’s normal GitHub Actions release path to publish trojani...
Compromised @asyncapi npm packages distributing the Miasma loader
Malware Activity
H score29
First: 15.07.2026 12:16
Last: 15.07.2026 12:16
Sources 1
About this happening:
Four compromised @asyncapi npm packages now deliver a multi-stage botnet loader when imported, exposing consumers to Miasma payloads during normal Node.js module load....
Compromised @asyncapi npm packages distributing the Miasma loader
Malware ActivityAbout this happening: Four compromised @asyncapi npm packages now deliver a multi-stage botnet loader when imported, exposing consumers to Miasma payloads during normal Node.js module load....
Malicious npm and PyPI payment SDK typosquat packages
Malware Activity
H score40
First: 09.07.2026 18:09
Last: 09.07.2026 18:09
Sources 1
About this happening:
The 17 malicious npm and PyPI packages targeted Paysafe, Skrill, and Neteller SDKs to steal system information and developer secrets, then send the data to an Ng...
Malicious npm and PyPI payment SDK typosquat packages
Malware ActivityAbout this happening: The 17 malicious npm and PyPI packages targeted Paysafe, Skrill, and Neteller SDKs to steal system information and developer secrets, then send the data to an Ng...
North Korean Contagious Interview PolinRider supply-chain campaign
Campaign
H score51
First: 04.07.2026 14:17
Last: 04.07.2026 14:17
Sources 1
How related:
The wallet address matches one documented by researchers at OpenSourceMalware, who named the technique NullReceiver and attributed the activity they examined to the DPRK-linked Contagious Interview campaign, associated with the Lazarus group.
About this happening:
The Contagious Interview / PolinRider campaign is still active, with 108 unique packages and browser extensions published across npm, Packagist, Go, and Google Chrome....
North Korean Contagious Interview PolinRider supply-chain campaign
CampaignHow related: The wallet address matches one documented by researchers at OpenSourceMalware, who named the technique NullReceiver and attributed the activity they examined to the DPRK-linked Contagious Interview campaign, associated with the Lazarus group.
About this happening: The Contagious Interview / PolinRider campaign is still active, with 108 unique packages and browser extensions published across npm, Packagist, Go, and Google Chrome....
AUDIOFIX and MiniRAT macOS malware activity
Malware Activity
H score34
First: 28.05.2026 10:54
Last: 28.05.2026 10:54
Sources 1
About this happening:
The AUDIOFIX and MiniRAT malware activity is targeting cryptocurrency firms and developer infrastructure on macOS with LinkedIn recruiter lures, a fake mee...
AUDIOFIX and MiniRAT macOS malware activity
Malware ActivityAbout this happening: The AUDIOFIX and MiniRAT malware activity is targeting cryptocurrency firms and developer infrastructure on macOS with LinkedIn recruiter lures, a fake mee...
Timeline
-
05.08.2026 16:41 2 articles · 13d ago
NullReceiver decodes 166.88.134[.]62 from Ethereum recipient bytes
Technical Analysis UpdateNullReceiver uses the hard-coded attacker wallet 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a to inspect its most recent outbound Ethereum transaction, read the recipient address bytes, and decode a C2 IP that resolves to 166.88.134[.]62 through a zero-value, zero-data transfer.
Show sources
- Trojanized npm Packages Decode C2 IP From Ethereum Recipient Addresses — thehackernews.com — 05.08.2026 16:41
- Trojanized npm Packages Decode C2 IP From Ethereum Recipient Addresses — thehackernews.com — 05.08.2026 16:41
-
05.08.2026 16:41 2 articles · 13d ago
Trojanized npm packages bianira-ui and fluid-type-ui are published
Campaign Scope UpdateThe trojanized npm packages bianira-ui and fluid-type-ui are published on July 28, 2026, with reported download counts of 109 and 587, and the JavaScript libraries use NullReceiver rather than smart contracts or calldata to recover the hidden C2 IP.
Show sources
- Trojanized npm Packages Decode C2 IP From Ethereum Recipient Addresses — thehackernews.com — 05.08.2026 16:41
- Six npm Packages Read C2 Addresses From Ethereum Wallet — www.infosecurity-magazine.com — 11.08.2026 18:00
-
05.08.2026 16:41 1 articles · 13d ago
Researchers describe NullReceiver as a deliberate improvement on EtherHiding
Initial DisclosureOpenSourceMalware describes NullReceiver, linked to North Korea, as a deliberate improvement on EtherHiding that hides a C2 IP inside the recipient address of a zero-value, zero-data Ethereum transfer instead of using a smart contract or calldata payload.
Show sources
- Trojanized npm Packages Decode C2 IP From Ethereum Recipient Addresses — thehackernews.com — 05.08.2026 16:41