Sonatype Research Labs published research findings showing that six npm packages retrieve their command-and-control server addresses from an attacker's Ethereum wallet.
Three of the six npm packages were well-known libraries that attackers stealthily hijacked. Anyone who installed the affected versions should remove them and check for any subsequent code that may have been executed.
Attackers hijacked three genuine libraries
Sonatype researcher Adam Reynolds says the six packages can be divided into two categories.
It appears that the publishing accounts of legitimate library publishers were compromised to facilitate the distribution of counterfeit versions.
These are @kolbo/mcp@1.57.1, agentgui@1.0.1127, and godot-kit@1.0.1786316795. They inserted a loader at the end of a file that was already part of the package, thereby preserving the original functionality.
The remaining three were purpose-built packages for malware distribution. These are envpack-conf@1.0.1, postcss-initial-provider@3.0.4, and tailwindcss-motion-advanced@1.0.1.
The first package contains configuration utilities, the second is a functioning PostCSS plugin, and the last package places the loader in a minified helper file.
Sonatype confirmed that all six code blocks use the same payload and Ethereum address.
When a victim runs the code, the loader queries Ethereum for information about the wallet's latest outgoing transaction and extracts bytes from the 'to' field of that transaction.
These bytes are converted into two IPv4 addresses. They serve as the primary and backup command-and-control servers for the malware. The transaction is used solely to store instructions on where the malware should connect.
Sonatype researchers stated the loader concurrently accesses multiple Ethereum endpoints and races them against each other. It then bundles its JSON-RPC requests and switches to the Blockscout API if direct requests fail.
After discovering the server, it makes two more attempts at the `/0x/cls` and `/0x/ls` endpoints, falling back to the `X-Payload-B64` response header if a regular GET request yields no result.
The returned result is Base64 and XOR decoded, then executed in the current Node.js process via the `eval()` function or launched as a separate child process.
NullReceiver is a more compact version of EtherHiding
This blockchain data retrieval scheme was discovered by OpenSourceMalware in two trojanized Tailwind CSS clones, bianira-ui and fluid-type-ui, and named NullReceiver.
The firm links this activity to the North Korea-linked "Contagious Interview" campaign and the Lazarus group. Sonatype confirmed a match in the wallet address.
NullReceiver removes a vulnerability in EtherHiding—a method which, according to Google Threat Intelligence, was developed by a North Korea-linked actor in October 2025.
EtherHiding hides a secret within a transaction's data field and always sends the transaction to a public Ethereum burn address, giving defenders a fixed point for monitoring.
NullReceiver does not send any data and does not reuse the destination. In the deconstructed OpenSourceMalware code snippet, the recipient bytes were identified as value 166.88.134.62, and the trailing bytes formed the string "helloipbot!!", which is the attacker's fingerprint.
In September 2025, Cryptopolitan reported that ReversingLabs discovered npm loaders colortoolv2 and mimelib2, which hid malware URLs inside Ethereum smart contracts linked to Stargazer's Ghost Network.
Sonatype stated it continues to investigate the related npm activity. Affected developers should remove the flagged npm packages. They should also watch for signs of second-stage payload execution.
end-content
