Loading malware…
NullReceiver is a blockchain-based command-and-control discovery technique implemented in malicious JavaScript loaders distributed through npm packages and compromised software repositories. It is associated with North Korean-linked Contagious Interview and DeceptiveDevelopment activity and has appeared in PolinRider software supply-chain compromises. Targets include software developers and downstream consumers of compromised dependencies.
The loader queries public Ethereum services for the latest outgoing transaction from a hardcoded attacker-controlled wallet, then decodes command-server IP addresses from the transaction’s recipient address. The signaling transactions carry no monetary value or input data and require no smart contract. Operators can redirect infected systems by issuing another transaction without modifying the distributed malware. Unlike EtherHiding, NullReceiver encodes infrastructure information in recipient-address bytes rather than contract storage or transaction input data.
Observed implementations support multiple Ethereum providers, concurrent or batched queries, and a blockchain-explorer API fallback. After resolving infrastructure, loaders retrieve additional payload stages and execute them within the current Node.js process or as detached child processes. Some implementations can recover a payload from an HTTP response header when ordinary retrieval fails.
Distribution has involved both purpose-built malicious packages impersonating legitimate developer utilities and hijacked packages that preserve their original functionality. Loaders have also been concealed as font assets or embedded in project configuration files, with execution triggered by hidden Visual Studio Code tasks when a project is opened. NullReceiver primarily identifies the infrastructure-resolution mechanism and associated loaders, rather than a distinct remote-access or credential-stealing payload.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The group also adopted NullReceiver, a blockchain-based method for locating command servers.
public/fonts/fa-solid-400.woff2, not a font. Plaintext JavaScript with a .woff2 extension. This is the NullReceiver loader.
The wallet address matches one documented by researchers at OpenSourceMalware, who named the technique NullReceiver and attributed the activity they examined to the DPRK-linked Contagious Interview campaign, associated with the Lazarus group.
15 distinct techniques documented for this family, organized by ATT&CK tactic.
PolinRider is supply-chain campaign that hides obfuscated JavaScript inside compromised developers' .vscode/tasks.json files, fake .woff2 fonts, and legitimate config files like tailwind.config.js, postcss.config.mjs, eslint.config.mjs, App.js and babel.config.cjs.
DPRK is now weaponizing those accounts to deploy the latest, and best, DPRK malware into npm.
SlippyNunchucks cible des individus sinophones au Sri Lanka via le détournement des mises à jour de QuickFox pour déployer le toolset DarkVigil (aka FDMTP) ; DeceptiveDevelopment remonte la chaîne d’approvisionnement logicielle : vol de credentials Git/SSH, injection de code malveillant dans des dépôts publics/privés
whose actual command is node ./public/fonts/fa-solid-400.woff2
a hidden VS Code task labeled “eslint-check,” set to "runOn": "folderOpen" , whose actual command is node ./public/fonts/fa-solid-400.woff2
The specific technique used against fetch-page-assets, a hidden VS Code task set to folderOpen invoking a non-code file, is a published PolinRider signature.
a hidden VS Code task labeled “eslint-check,” set to "runOn": "folderOpen" , whose actual command is node ./public/fonts/fa-solid-400.woff2
The specific technique used against fetch-page-assets, a hidden VS Code task set to folderOpen invoking a non-code file, is a published PolinRider signature.
PolinRider is supply-chain campaign that hides obfuscated JavaScript inside compromised developers' .vscode/tasks.json files, fake .woff2 fonts, and legitimate config files
public/fonts/fa-solid-400.woff2, not a font. Plaintext JavaScript with a .woff2 extension.
fake .woff2 fonts... public/fonts/fa-solid-400.woff2, not a font. Plaintext JavaScript with a .woff2 extension.
removed the visible symptom but missed mechanism... the fake public/fonts/fa-solid-400.woff2 payload disappeared from the shipped tarball... But the trigger, .vscode/tasks.json ... was left in place
C2 URI paths (against attacker-resolved IP) http://<resolved-ip>:443/0x/cls http://<resolved-ip>:443/0x/ls
“EtherHiding/NullReceiver [is used] for staged C2 delivery.”
The malware can retrieve new instructions from a public blockchain that cannot easily be taken down or altered by defenders.
Anyone running npm install fetch-page-assets today gets both loaders.
Instead of relying on a visible web domain or a fixed server address, the malware can retrieve new instructions from a public blockchain that cannot easily be taken down or altered by defenders.
18 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.