Sonatype Research Labs released findings that six npm packages pull their command server locations from an attacker’s Ethereum wallet.
Three of the six npm packages were well-known libraries that attackers quietly took over. Anyone who installed the affected versions should remove them and look for any follow-on code that may have executed.
Attackers hijacked three real libraries
Sonatype researcher Adam Reynolds says the six packages fall into two buckets.
The publishing accounts of real libraries appear to have been compromised so a poisoned version could ship.
These are @kolbo/mcp@1.57.1, agentgui@1.0.1127, and godot-kit@1.0.1786316795. They placed the on the end of a file that already came with the package, thus preserving the original functionality.
The other three were custom-built packages to carry the malware. They are envpack-conf@1.0.1, postcss-initial-provider@3.0.4, and tailwindcss-motion-advanced@1.0.1.
The first package ships configuration helpers, the other ships a working PostCSS plugin, and the last package buries the inside a minified utility file.
Sonatype confirmed that all six code blocks are using the same payload and Ethereum wallet.
When the victim runs the code, the queries Ethereum for the wallet’s last outbound transaction and extracts bytes from the recipient field of that transaction.
Those bytes translate to two IPv4 addresses. They serve as primary and secondary command-and-control servers for the malware. The transfer exists only to stash instructions on where the malware should connect.
Sonatype researchers said the hits multiple Ethereum RPC providers at once and races them against each other. It then batches its JSON-RPC calls and falls back to the Blockscout API if direct queries fail.
Once it finds a server, it tries two more stages at the endpoints /0x/cls and /0x/ls, falling back to an X-Payload-B64 response header when a plain GET does not deliver the goods.
What comes back is Base64- and XOR-decoded, then run in the current Node.js process through eval() or spawned as a detached child process.
NullReceiver is a leaner EtherHiding
This on-chain retrieval scheme was seen by OpenSourceMalware in two trojanized Tailwind CSS clones, bianira-ui and fluid-type-ui, and was named NullReceiver.
The activity is linked by the firm to the DPRK-linked Contagious Interview campaign associated with the Lazarus group. Sonatype verified the wallet match.
NullReceiver addresses a gap in EtherHiding, the technique Google Threat Intelligence attributed to a DPRK-linked actor in October 2025.
EtherHiding hides the secret inside the data field of a transaction and always sends to Ethereum’s public burn address, giving defenders a fixed point of reference to watch.
NullReceiver sends no data and does not reuse a destination. In the sample OpenSourceMalware deconstructed, the recipient bytes decoded to 166.88.134.62, with the trailing bytes spelling the string “helloipbot!!” as an attacker fingerprint.
In September 2025, Cryptopolitan reported that ReversingLabs had discovered npm downs colortoolv2 and mimelib2, which concealed malware URLs inside Ethereum smart contracts and were linked to Stargazer’s Ghost Network.
Sonatype said it is still looking into related npm activity. Affected developers should remove the flagged npm packages. They should also be looking for signs that a second-stage payload was executed.