DPRK-Linked npm Packages Used NullReceiver Ethereum-Based C2 Resolution

Researchers identified a new blockchain-based command-and-control resolution technique dubbed NullReceiver in two trojanized npm packages, bianira-ui@1.27.0 and fluid-type-ui@2.0.8, tied to the DPRK-linked Contagious Interview campaign. The packages use a hardcoded Ethereum wallet, 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a, and recover their next-stage infrastructure by querying the wallet’s latest zero-value, zero-data Ethereum transaction rather than relying on embedded domains or traditional blockchain-stored payloads.

Analysis showed the malware decodes the command-and-control IP directly from the recipient address of that blank transaction, yielding 166.88.134.62, with ports 443 and 80 identified as associated infrastructure. Researchers said the approach improves on EtherHiding by avoiding smart contracts, calldata, and fixed public sink addresses, making the C2 lookup harder to spot while leaving only minimal on-chain artifacts; the findings were derived from static analysis of the published npm tarballs and review of public blockchain activity without executing the packages.