OpenSourceMalware found malicious npm packages using NullReceiver, a blockchain-based C2 hiding method that stores data in recipient addresses
Security community platform OpenSourceMalware recently discovered two trojanized npm packages, "bianira-ui" and "fluid-type-ui". Their attack flow differs from traditional EtherHiding, and researchers named this technique NullReceiver, believing the activity may be linked to a North Korean threat group.
The significance of this incident lies not only in the malicious packages themselves, but also in the fact that attackers have turned blockchain transaction mechanisms into part of their malicious infrastructure. In the past, supply-chain attacks often relied on victims downloading code and then connecting to a traditional C2. This case shows that attackers can hide related information on-chain, making malicious communications much harder to block directly with static rules.
According to public intelligence, as of August 12, 2026, npm packages using the NullReceiver method had reached 15 in total, indicating that this technique is not a one-off incident but an attack pattern that can be replicated and spread.
EtherHiding is a type of Dead Drop Resolver (DDR) technique. Its concept is to place malicious commands or C2 information on a legitimate third-party platform or blockchain, using their public visibility and persistence to reduce takedown risk. Traditional methods usually write malicious content into the transaction input data field, making the malicious information appear to be just part of normal on-chain data.
NullReceiver changes the concealment location. Instead of placing the C2 in input data, it puts it directly into the transaction receiver address. This means the malicious information no longer appears prominently in the data field, but is disguised as part of the transaction itself, increasing the difficulty for defenders to identify and track the related infrastructure.
In known analysis, one transaction from attacker wallet 0xA658863Ea658863E68656C6c6f6970626f742121 had input data of 0x, without using the traditional EtherHiding payload format; the actual carrier of the information was the recipient address. Decoding that address reveals a malicious relay IP of 166[.]88.134.62. This shows that the attacker transmits information through address bytes, shifting the existence of the C2 from the "transaction content" to the "transaction target" itself.
NullReceiver also optimizes cost design. According to the data, the traditional method of writing malicious commands into input data costs about 1 to 2 dollars per update; by comparison, the base transaction cost on Ethereum is 21,000 gas, equivalent to about 1 dollar. When malicious information is encoded into the recipient address and written to the blockchain through a normal transaction, attackers can maintain low-cost updates and reduce infrastructure rotation and operational burden.
Therefore, the core breakthrough of NullReceiver is not just that it hides more deeply, but that it looks more like a normal transaction. For defenders, this compresses the hit rate of existing signature databases and increases the workload of intelligence tracing and IOC correlation analysis.
This incident first affects developers in the npm ecosystem and downstream users in the supply chain. As long as a project installs a trojanized package, it may load concealed malicious logic during development or deployment, and then contact subsequent payloads or C2 communications.
The second layer of impact is detection. Traditional analysis of malicious blockchain activity often focuses on transaction input data, smart contracts, or obvious anomalous payloads. But by moving the key information to the receiver address, NullReceiver weakens the hit rate of existing signature databases and increases the workload of intelligence tracing and IOC correlation analysis.
The third layer of impact is attack spread speed. When the technique has been adopted by multiple npm packages, it suggests that attackers may be testing a reusable supply-chain delivery pattern. For enterprises, this is not just a single malicious package issue, but a need to simultaneously monitor package sources, dependency relationships, CI/CD processes, and anomalous on-chain behavior as part of the overall risk.
First, immediately inventory npm dependencies and lock files to determine whether bianira-ui or fluid-type-ui have ever been used, and expand checks to similar UI packages and recently added dependencies. If related packages already exist in the environment, they should be isolated, removed, and the affected build environment rebuilt as a priority.
Second, establish monitoring for outbound traffic and on-chain query behavior. Because the core of NullReceiver is reading C2 information from the blockchain, defenders should pay special attention to whether applications show unusual Ethereum queries, wallet address resolution, or connection behavior related to known IOCs.
Third, it is recommended to introduce package source verification, version pinning, SBOM management, and abnormal dependency review into development and deployment workflows. For pipelines that interact with external packages, whether on-chain information is being used as a decoding basis should be included in threat modeling, rather than checking only traditional domain and IP blocklists.
Finally, SOC and threat-hunting teams should handle IOCs and TTPs in parallel. Known IOCs in this case include attacker wallet address 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a and malicious relay IP 166[.]88.134.62; but more importantly, detection rules should be built around behavioral features such as "empty transactions," "recipient address decoding," and "low-cost on-chain updates" to improve coverage of similar variants.
166[.]88.134.62.0xa322e5f3d311d3080e6f0121063e9adc2490ef1a to detection and blocking rules.