Trojanized npm Packages Employ NullReceiver Tactic to Decode C2 IP from Blockchain
NullReceiver is an evolved blockchain-based C2 technique that encodes command-and-control IP addresses directly within the bytes of a fake, never-before-seen Ethereum destination address in zero-value, zero-data transfers The technique was discovered in two trojanized npm packages ("bianira-ui" and "fluid-type-ui"), linked to North Korean threat actors, and represents a deliberate improvement over the previously documented EtherHiding method Unlike EtherHiding, which requires a fixed, watchable
Analysis
TL;DR
- NullReceiver is an evolved blockchain-based C2 technique that encodes command-and-control IP addresses directly within the bytes of a fake, never-before-seen Ethereum destination address in zero-value, zero-data transfers
- The technique was discovered in two trojanized npm packages ("bianira-ui" and "fluid-type-ui"), linked to North Korean threat actors, and represents a deliberate improvement over the previously documented EtherHiding method
- Unlike EtherHiding, which requires a fixed, watchable destination address and smart contract interactions, NullReceiver generates a unique throwaway address for every lookup, eliminating fingerprinting opportunities and reducing gas costs to near-zero
- The malware decodes C2 IPs by extracting the first four bytes from the destination address of the attacker's most recent outbound transaction and converting them from hexadecimal to decimal IP format
- Both trojanized packages have been removed from npm but collectively received over 696 downloads since their publication on July 28, 2026
Why It Matters
This development represents a significant escalation in supply chain attack sophistication, demonstrating how threat actors are leveraging blockchain's pseudonymous nature to create increasingly resilient and undetectable command-and-control infrastructure. For AI and software practitioners, it underscores the critical importance of supply chain security and the need for enhanced monitoring of npm dependencies, as even seemingly benign UI packages can serve as vectors for advanced persistent threats.
Technical Details
- NullReceiver encodes C2 IP addresses within Ethereum transaction destination addresses by converting the first four bytes of a fabricated address from hexadecimal to decimal (e.g., "a658863e" → "166.88.134.62"), with trailing bytes potentially containing ASCII signatures like "helloipbot!!"
- The technique operates through a four-step execution chain: the trojanized JavaScript library looks up a hard-coded attacker wallet ("0xa322e5f3d311d3080e6f0121063e9adc2490ef1a"), retrieves its most recent outbound transaction, reads the destination address, and decodes the C2 IP from the first four address bytes
- NullReceiver eliminates the fixed destination address problem of EtherHiding by generating a unique, never-before-seen throwaway address for each lookup, making defensive monitoring and attribution significantly more difficult
- The technique requires no smart contract interactions and no calldata payload, making transactions the cheapest and least conspicuous shape on the Ethereum network since gas costs are not incurred per byte as with calldata
- A total of 68 blockchain transactions were observed since July 27, 2026, all targeting the same fabricated destination pattern, with the trojanized packages receiving 109 and 587 downloads respectively before removal from npm
Industry Insight
- Security teams should implement enhanced supply chain monitoring that includes behavioral analysis of npm package network activity, particularly for packages that make blockchain or wallet-related API calls, as these may indicate NullReceiver-style C2 communication
- The evolution from EtherHiding to NullReceiver suggests that threat actors are systematically addressing defensive countermeasures, indicating a need for proactive threat intelligence sharing around blockchain-based C2 techniques and the development of detection heuristics for anomalous Ethereum transaction patterns
- Organizations relying on open-source dependencies should adopt stricter package verification practices, including signature validation, dependency auditing tools, and network-level monitoring for outbound connections to IPs derived from blockchain lookups, as traditional signature-based detection will likely miss this type of stealthy supply chain compromise
Disclaimer: The above content is generated by AI and is for reference only.