Cybersecurity researchers have identified a new iteration of blockchain-based command-and-control (C2) that aims to make defender analysis significantly harder. In short: trojanized npm packages use a technique called NullReceiver C2 IP to extract an attacker-controlled IP address from seemingly ordinary Ethereum transfer details.
The activity has been linked to North Korea, and the affected packages—bianira-ui and fluid-type-ui—are no longer available for download from npm. Still, their download counts show that the malicious code reached a number of users before removal.
What is NullReceiver C2 IP?
NullReceiver is described as a deliberate improvement over an earlier blockchain concealment approach sometimes referred to as EtherHiding. While EtherHiding hides C2-related information in smart-contract code or other transaction elements, NullReceiver changes the location and structure of the hidden data.
Instead of hardcoding a C2 address or embedding it in transaction calldata, this approach encodes the C2 IP directly into the bytes of the recipient address of a zero-value, zero-data Ethereum transfer. From a defender’s perspective, this matters because the transfer appears designed to carry almost nothing—yet it becomes a carrier for the decoded network destination.
How the trojanized npm packages operate
The two npm packages associated with this campaign—bianira-ui and fluid-type-ui—do not introduce a smart contract call and do not place malicious content into calldata. Instead, they act as JavaScript libraries that perform a sequence of steps on the victim machine to obtain the C2 IP and then connect to it.
The process, as described by researchers, follows these stages:
- Query a hard-coded attacker wallet: the code uses a specific wallet address to begin the lookup.
- Retrieve the most recent outbound transaction from that wallet.
- Read the transaction’s destination (“To”) address.
- Decode the C2 IP from address bytes: the first four bytes of the hexadecimal representation are converted into their numeric equivalent to form an IP address.
- Connect to the decoded IP to proceed with the C2 communication.
As an example observed in the analysis, the campaign used a hard-coded attacker wallet. The “To” address used across these transactions includes both the numeric bytes that map to an IP address and additional trailing bytes that correspond to an ASCII string.
Why this is harder to detect than EtherHiding
NullReceiver’s core goal is to remove predictable markers that defenders typically rely on. With EtherHiding, the concealment often depends on fixed, publicly known destination patterns. Even when defenders do not immediately recognize the payload, the destination can remain trackable because new transactions must carry the C2-related information for the malware to function.
NullReceiver changes this dynamic in multiple ways:
- No fixed destination to watch: the technique uses a non-existent destination address as the encoding container. The address is essentially a temporary vehicle for data.
- No smart contract and no calldata payload: by avoiding those fields, the malware reduces the number of obvious forensic targets defenders might search for.
- Limited data capacity: the method can encode only a few bytes, unlike approaches that can smuggle larger scripts or full URLs. That constraint is a trade-off, but it also makes the transaction structure less suspicious.
OpenSourceMalware characterizes the technique as never reusing the same destination. Each lookup generates a brand-new throwaway address, which reduces the likelihood that investigators can find repeated patterns in the blockchain.
Blank transfers and cheaper blockchain activity
Another factor making NullReceiver more evasive is the transaction design. Researchers note that calldata can increase gas costs because it scales with byte size. In contrast, NullReceiver uses a zero-value, zero-data transfer, which results in a blank transaction “shape” on the network.
Practically, that means fewer conspicuous signals: no extra fields to fingerprint and no payload to review in the usual places. For defenders, this can translate into less analyst-friendly artifacts and fewer obvious heuristics to automate detection.
Observed npm packages and their impact
The trojanized packages were published on npm and later removed. According to the reported statistics, they had been downloaded a few hundred times after their initial publication on July 28, 2026.
- bianira-ui: 109 downloads
- fluid-type-ui: 587 downloads
Both packages were associated with npm users identified in the reporting. While the packages are no longer accessible for download, the fact that hundreds of installations occurred before removal highlights the continuing risk of supply-chain compromise.
Link to larger North Korea-associated activity
The campaign is connected to North Korea-related operations. Researchers also referenced broader context: Google Threat Intelligence Group (GTIG) previously described EtherHiding usage by North Korean hacking groups in relation to a long-running campaign known as Contagious Interview. That campaign reportedly targets potential victims through LinkedIn outreach with job opportunities, followed by an assessment intended to lead to malware deployment.
In this latest development, the message is clear: threat actors are continuing to refine tactics and adjust how they hide C2 details to make detection and attribution more difficult.
What defenders can take away
NullReceiver C2 IP emphasizes that not every blockchain-based technique reveals itself through obvious payloads. Instead of hiding a full instruction set or URL, the malware reads a recent transaction and extracts just enough data to reach the C2 server.
From a defensive perspective, it is worth focusing on:
- npm package review and monitoring for unusual dependency behavior, especially when packages are removed after short periods;
- runtime analysis of libraries that perform blockchain lookups and decoding logic;
- network monitoring for outbound connections to decoded IPs that may not follow typical hardcoded patterns.
While this report describes specific wallets and observed “To” address structures, the bigger lesson is methodological: attackers can shift where information sits on-chain and vary destination addresses to reduce repeatability.
Conclusion
The discovery of NullReceiver C2 IP in trojanized npm packages shows how adversaries can evolve blockchain concealment techniques. By encoding the C2 IP within the bytes of the recipient address in blank Ethereum transfers—and by avoiding fixed destinations—this approach aims to minimize detection opportunities.
As supply-chain attacks continue to leverage trusted ecosystems like npm, the combination of package compromise and sophisticated C2 extraction logic remains a serious threat. Staying alert to both dependency-level risks and the behavioral signals of blockchain-driven malware is essential.
Source: https://thehackernews.com/2026/08/trojanized-npm-packages-decode-c2-ip.html
