Cybersecurity researchers have identified a sophisticated evolution in malware deployment techniques, where attackers embed command-and-control (C2) server IP addresses within Ethereum transaction recipient fields. This method, dubbed ‘NullReceiver,’ has been observed in two malicious npm packages: ‘bianira-ui’ and ‘fluid-type-ui.’
Traditionally, malware developers have sought innovative ways to conceal their C2 infrastructure to evade detection and takedown efforts. The ‘NullReceiver’ technique represents a significant advancement in this cat-and-mouse game. Instead of hardcoding C2 addresses or embedding them in transaction data fields—a method known as ‘EtherHiding’—attackers now encode the C2 IP directly within the recipient address of a zero-value Ethereum transaction. This approach eliminates the need for a fixed, publicly known destination address, thereby reducing the risk of detection.
The process unfolds as follows: the malicious npm packages are designed to look up a specific attacker-controlled Ethereum wallet. They then retrieve the most recent outbound transaction from this wallet and extract the destination address. By decoding the first four bytes of this address from their hexadecimal representation, the malware derives the C2 IP address. Subsequently, the infected system establishes a connection to this IP, facilitating further malicious activities.
Both ‘bianira-ui’ and ‘fluid-type-ui’ were uploaded to the npm registry on July 28, 2026, by users ‘npmuser1101’ and ‘npmuser3002,’ respectively. While these packages have since been removed from npm, download statistics indicate that ‘bianira-ui’ was downloaded 109 times, and ‘fluid-type-ui’ 587 times, before their removal. This suggests a potentially significant impact on developers who integrated these packages into their projects.
The ‘NullReceiver’ technique builds upon the previously documented ‘EtherHiding’ method, which involved embedding malicious code within smart contracts on public blockchains like Ethereum or BNB Smart Chain. By leveraging the immutable and decentralized nature of blockchain technology, attackers can maintain resilient C2 infrastructures that are challenging to disrupt. However, ‘NullReceiver’ enhances this approach by eliminating the need for a fixed destination address, thereby further obfuscating the C2 server’s location.
Notably, this method has been linked to North Korean threat actors, who have a history of employing sophisticated techniques to achieve their objectives. The use of blockchain-based C2 mechanisms underscores the evolving landscape of cyber threats and the need for continuous adaptation in defensive strategies.
For developers and organizations, this development serves as a stark reminder of the importance of scrutinizing third-party packages before integration. Implementing robust supply chain security measures, such as verifying the authenticity of packages and monitoring for unusual network activity, is crucial. Additionally, staying informed about emerging attack vectors can aid in preemptively mitigating potential threats.
As attackers continue to refine their methods, the cybersecurity community must remain vigilant and proactive. The ‘NullReceiver’ technique exemplifies the innovative tactics adversaries are willing to employ, highlighting the necessity for adaptive and comprehensive security practices in the ever-evolving digital landscape.
