North Korean-linked attackers are using a new way to hide the servers that control malware.
The method places a command server address inside an empty Ethereum transaction, making the activity look like a normal crypto transfer rather than a malware signal.
The technique was found in two malicious npm packages, bianira-ui version 1.27.0 and fluid-type-ui version 2.0.8.
Both packages impersonated legitimate Tailwind CSS plugins, creating a supply-chain risk for developers who install dependencies without closely reviewing their source.
Analysts at OpenSource Malware identified the activity and named the technique NullReceiver.
OpenSource Malware said in a report shared with Cyber Security News (CSN) that the campaign appears connected to the DPRK-linked Contagious Interview operation, which has repeatedly targeted developers through trusted-looking projects and packages.
The discovery shows how software supply-chain threats are becoming harder to spot. Instead of relying on a visible web domain or a fixed server address, the malware can retrieve new instructions from a public blockchain that cannot easily be taken down or altered by defenders.
North Korean Hackers Are Hiding Malware Servers
NullReceiver works by reading the recipient address from the latest outgoing transaction of an attacker-controlled Ethereum wallet. That recipient is not a genuine payment destination.
Its address bytes are deliberately chosen so that part of the value converts into the IP address of the malware’s command-and-control server.
The transfer contains no payment value and no transaction input data. This helps it blend into ordinary blockchain activity because there is no smart contract call, hidden script, or payload field for security tools to inspect.
The decoded command server directs infected systems to the next stage of the operation.
This design differs from EtherHiding, where attackers store command data in a transaction’s calldata or a smart contract.
.webp)
NullReceiver is more limited because it can only carry a small amount of information, such as an IP address.
However, it is cheaper to operate, less obvious on-chain, and avoids EtherHiding’s use of a predictable destination address that defenders can monitor from the start.
Supply Chain Risks Grow
The affected packages use Node.js code to query public Ethereum remote procedure call services, examine the attacker wallet’s latest transfer, decode the recipient address, and contact the resulting server.
Researchers did not execute the packages; their findings came from static analysis and read-only blockchain checks.
The attack is especially concerning for developers because malicious npm dependencies can enter workstations, build systems, and software projects through everyday installation commands.
Security teams should review dependency updates before deployment, investigate unexpected outbound blockchain RPC traffic, and monitor for applications that inspect transaction recipient addresses.
Once a malicious wallet is known, defenders can track its transfers and identify newly encoded infrastructure before infected systems connect.
Organizations should also restrict unnecessary access to cryptocurrency RPC providers, isolate machines that installed the identified packages, and rotate exposed developer credentials.
These precautions matter as North Korean developer targeting continues to rely on convincing software lures rather than software vulnerabilities alone.
Indicators of Compromise (IoCs):-
| Type | Indicator | Description |
|---|---|---|
| Malicious npm package | bianira-ui@1.27.0 |
Trojanized npm package using NullReceiver |
| Malicious npm package | fluid-type-ui@2.0.8 |
Trojanized npm package using NullReceiver |
| Ethereum wallet | 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a |
Attacker-controlled wallet queried by the malware |
| Encoded recipient address | 0xa658863ea658863e68656c6c6f6970626f742121 |
Recipient address used to encode the C2 IP and helloipbot!! marker |
| C2 IP address | 166.88.134.62 |
Decoded command-and-control infrastructure |
| C2 endpoint | 166.88.134.62:443 |
HTTPS command-and-control endpoint |
| C2 endpoint | 166.88.134.62:80 |
HTTP command-and-control endpoint |
| Blockchain RPC URL | https://1rpc.io/eth |
Ethereum RPC service queried by the malware |
| Blockchain RPC URL | https://eth.drpc.org |
Ethereum RPC service queried by the malware |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.