The burn address was the free detection signal, and npm attackers just gave it up

Sonatype Research Labs says it found six npm packages that pull their command-and-control addresses out of an attacker's Ethereum wallet, and three of the six were well-known libraries whose publishing accounts appear to have been compromised so a poisoned release could ship ^[1][2]. The consequence for anyone running detection is narrow and specific: the scheme, which OpenSourceMalware named NullReceiver, discards the artefact that made the earlier EtherHiding technique cheap to catch ^[13][16][17].

The mechanics are modest. On execution, the loader asks Ethereum for the wallet's last outbound transaction and pulls bytes out of the recipient field ^[7]. Those bytes decode to two IPv4 addresses, used as primary and secondary command servers; the transfer carries no value or instruction beyond that, existing only to park the addresses on-chain ^[8][9]. The loader queries several Ethereum RPC providers at once and races them, batches its JSON-RPC calls, and falls back to the Blockscout API when direct queries fail ^[10]. Having found a server, it tries `/0x/cls` and `/0x/ls`, with an `X-Payload-B64` response header as a fallback when a plain GET returns nothing ^[11]. What comes back is Base64- and XOR-decoded, then run through `eval()` in the live Node process or spawned as a detached child ^[12].

EtherHiding, which Google Threat Intelligence attributed to a DPRK-linked actor in October 2025, put its secret in the transaction data field and always sent to Ethereum's public burn address, which handed defenders a fixed reference point to monitor ^[15][16]. NullReceiver sends no data and does not reuse a destination ^[17]. That removes a one-line heuristic and replaces it with the harder problem of deciding which of many ordinary-looking transfers is a configuration record. In the sample OpenSourceMalware pulled apart, the recipient bytes decoded to 166.88.134.62, with trailing bytes spelling "helloipbot!!" as an attacker fingerprint ^[18].

The distribution side deserves more attention than the on-chain trick. Sonatype researcher Adam Reynolds puts the six packages into two buckets ^[21]. The hijacked releases were @kolbo/[email protected], [email protected] and [email protected], with the loader appended to a file the package already shipped so the original behaviour survived ^[2][3]. The purpose-built carriers were [email protected], [email protected] and [email protected]: configuration helpers, a functioning PostCSS plugin, and a minified utility file with the loader buried inside ^[4][5]. Half the set therefore arrived under names a developer had already decided to trust ^[22]. Sonatype confirmed all six run the same payload against the same wallet ^[6].

None of this is a first. OpenSourceMalware saw the same retrieval scheme in two trojanized Tailwind CSS clones, bianira-ui and fluid-type-ui, and links the activity to the DPRK-linked Contagious Interview campaign associated with Lazarus; Sonatype verified the wallet match ^[13][14]. In September 2025, ReversingLabs found npm downloaders colortoolv2 and mimelib2 hiding malware URLs inside Ethereum smart contracts, tied to Stargazer's Ghost Network ^[19].

Sonatype says it is still investigating related npm activity, and its advice to affected developers is to remove the flagged packages and then look for evidence that a second-stage payload actually ran ^[20]. The second half is the expensive half.