New Ethereum-Based Malware Technique Found in npm Packages
North Korean-linked hackers hide command-and-control servers in Ethereum addresses.
1What is NullReceiver Technique?
NullReceiver is a novel technique that conceals malware's command-and-control (C2) server IP within the recipient address of a zero-value Ethereum transfer. Described as an evolution of EtherHiding by OpenSourceMalware, this method eliminates fixed destination addresses, generating disposable ones for each operation to evade detection. The approach represents a significant advancement in blockchain-based malware distribution.
2Affected npm Packages
Two npm packages, bianira-ui and fluid-type-ui, were found distributing malware using the NullReceiver technique. Published in July 2026, these packages were downloaded hundreds of times before being removed from npm. Investigations have linked these packages to North Korean hacking groups. Security teams warn that systems with these dependencies might still be compromised even after package removal.
3Key Differences from EtherHiding
While EtherHiding embeds malicious code within smart contracts, NullReceiver uses completely empty transactions. The C2 IP is encoded directly into the bytes of the recipient address. This approach reduces gas costs significantly while making tracking nearly impossible. Unlike EtherHiding which can smuggle full URLs, NullReceiver can only encode a few bytes of data, limiting payload size but improving stealth.
4Technical Execution
The malware connects to the attacker's wallet and reads the recipient address from the most recent transaction. The C2 IP is then decoded from the address bytes. For example, the address 0xa658863ea658863e68656c6c6f6970626f742121 decodes to IP 166.88.134.62 and ASCII string helloipbot!!. Notably, this technique requires no smart contract interaction or payload field, making it exceptionally lightweight.
5Enhanced Stealth Capabilities
NullReceiver's disposable address approach leaves no fixed target for defenders to monitor. Transactions contain no additional data fields, eliminating fingerprinting opportunities. With minimal gas costs (as empty transactions are the cheapest possible), these transfers blend seamlessly into normal network activity. The technique represents a paradigm shift in blockchain-based C2 infrastructure, prioritizing complete anonymity over payload capacity.
6North Korean Connection
Google's Threat Intelligence Group (GTIG) previously linked EtherHiding to North Korean hacking groups in late 2023 through their Contagious Interview campaign. That operation used LinkedIn job offers to deliver malware. NullReceiver demonstrates these groups' continued innovation in blockchain-based attack vectors. The technique's sophistication suggests state-sponsored development resources behind its creation.
7Industry Implications
Such sophisticated attacks on open-source ecosystems pose critical risks for enterprise users. Popular package managers like npm can rapidly distribute compromised packages through automatic updates. Security teams now must monitor not just package contents but also dependency behaviors. The incident highlights growing challenges in maintaining software supply chain security against nation-state level threats.
8Recommended Defensive Measures
Organizations must implement continuous monitoring of open-source dependencies with behavioral analysis. Unexpected network connections from npm packages should raise immediate red flags. Security teams should treat empty Ethereum transactions as suspicious. As threats evolve at machine speed, adopting AI-driven security solutions and comprehensive risk governance frameworks has become essential for modern cybersecurity defense.