Trojanized npm Packages Employ Null Receiver Tactic to Decode C2 IP from Blockchain
Summary: Researchers at OpenSourceMalware documented a technique called NullReceiver, used in two trojanized npm packages, bianira-ui and fluid-type-ui, that encodes a command-and-control IP address in the recipient bytes of a zero-value, zero-data Ethereum transfer rather than in a smart contract or calldata. The packages, downloaded a few hundred times since their July 28, 2026 publication, are tied to North Korea, and the wallet transactions share a destination address whose leading bytes decode to 166.88.134[.]62.
What's compelling: NullReceiver never reuses a destination address and carries no calldata field, so the fixed, watchable target defenders relied on with EtherHiding is gone, and 68 transactions have already been recorded since July 27, 2026. The same shared infrastructure linked these packages to PolinRider, which Gile says has spent at least five months compromising thousands of developer machines to push backdoored commits without human intervention.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026