NullReceiver abandons the recording address that made EtherHiding easy to detect
**Sonatype Research Labs has uncovered six malicious npm packages that retrieve command-and-control server addresses from an attacker's Ethereum wallet.**
Three of the packages are legitimate, popular libraries that were compromised: `@kolbo/mcp`, `agentgui`, and `godot-kit`. The other three are purely malicious packages: `envpack-conf`, `postcss-initial-provider`, and `tailwindcss-motion-advanced`. All six deploy the same payload.
The malware loader queries the Ethereum blockchain for the latest outgoing transaction from a specific wallet. It extracts bytes from the recipient field of that transaction, converts them into two IPv4 addresses, and uses these as primary and backup command-and-control servers. After connecting, it fetches, decodes, and executes a second-stage payload using `eval()` or by spawning a child process.
This method, dubbed **"NullReceiver,"** is an evolution of the earlier "EtherHiding" technique. While EtherHiding hid data in transaction fields and sent funds to a fixed "burner" address (creating a monitoring point), NullReceiver sends no funds and generates unique, dynamic receiver addresses, making detection harder. OpenSourceMalware has linked this activity to the North Korean Lazarus group's "Contagious Interview" campaign.
Sonatype advises developers to remove the affected package versions immediately and check their systems for signs of secondary payload execution.
cryptonews.ru42m ago