NullReceiver trojanized npm packages C2 via Ethereum recipient address
Malware Activity
Summary
Hide ▲
Show ▼
NullReceiver is a new malware activity that hides a C2 IP inside Ethereum recipient addresses, allowing trojanized npm packages to decode and contact the server without a smart contract or calldata payload. The activity was observed in bianira-ui and fluid-type-ui, which were published on July 28, 2026 and later removed from npm. The packages were downloaded a few hundred times before takedown and were linked to North Korea. The technique reduces defender visibility by using a throwaway-looking blockchain transfer as the dead drop.
Related Happenings
AUDIOFIX and MiniRAT macOS malware activity
Malware Activity
H score34
First: 28.05.2026 10:54
Last: 28.05.2026 10:54
Sources 1
About this happening:
The AUDIOFIX and MiniRAT malware activity is targeting cryptocurrency firms and developer infrastructure on macOS with LinkedIn recruiter lures, a fake mee...
AUDIOFIX and MiniRAT macOS malware activity
Malware ActivityAbout this happening: The AUDIOFIX and MiniRAT malware activity is targeting cryptocurrency firms and developer infrastructure on macOS with LinkedIn recruiter lures, a fake mee...
Jason Saayman hit by network compromise
Incident
H score18
First: 31.03.2026 16:53
Last: 31.03.2026 16:53
Sources 1
About this happening:
The Axios npm package was compromised after maintainer Jason Saayman's npm account was taken over, and malicious versions were published to the registry. The release c...
Jason Saayman hit by network compromise
IncidentAbout this happening: The Axios npm package was compromised after maintainer Jason Saayman's npm account was taken over, and malicious versions were published to the registry. The release c...
Latest development: 01.04.2026 12:00
Google Threat Intelligence Group attributed the Axios npm supply-chain compromise to UNC1069, citing the use of WAVESHAPER.V2 and describing the actor as financially motivated and North Korea-nexus. GTIG also warned that malicious axios releases v1.14.1 and v0.30.4, delivered through Jason Saayman’s compromised account and plain-crypto-js, could have a broad blast radius across dependent packages and developer environments.
Timeline
-
05.08.2026 16:41 2 articles · 3h ago
NullReceiver decodes 166.88.134[.]62 from Ethereum recipient bytes
Technical Analysis UpdateNullReceiver uses the hard-coded attacker wallet 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a to inspect its most recent outbound Ethereum transaction, read the recipient address bytes, and decode a C2 IP that resolves to 166.88.134[.]62 through a zero-value, zero-data transfer.
Show sources
- Trojanized npm Packages Decode C2 IP From Ethereum Recipient Addresses — thehackernews.com — 05.08.2026 16:41
- Trojanized npm Packages Decode C2 IP From Ethereum Recipient Addresses — thehackernews.com — 05.08.2026 16:41
-
05.08.2026 16:41 1 articles · 3h ago
Trojanized npm packages bianira-ui and fluid-type-ui are published
Campaign Scope UpdateThe trojanized npm packages bianira-ui and fluid-type-ui are published on July 28, 2026, with reported download counts of 109 and 587, and the JavaScript libraries use NullReceiver rather than smart contracts or calldata to recover the hidden C2 IP.
Show sources
- Trojanized npm Packages Decode C2 IP From Ethereum Recipient Addresses — thehackernews.com — 05.08.2026 16:41
-
05.08.2026 16:41 1 articles · 3h ago
Researchers describe NullReceiver as a deliberate improvement on EtherHiding
Initial DisclosureOpenSourceMalware describes NullReceiver, linked to North Korea, as a deliberate improvement on EtherHiding that hides a C2 IP inside the recipient address of a zero-value, zero-data Ethereum transfer instead of using a smart contract or calldata payload.
Show sources
- Trojanized npm Packages Decode C2 IP From Ethereum Recipient Addresses — thehackernews.com — 05.08.2026 16:41