Since late July 2026, two npm packages have been circulating that carry neither a domain nor a contact IP anywhere in their code. To learn which server to reach, they read a blank Ethereum transfer and pull their command-and-control (C2) address out of the bytes of a recipient that does not really exist as a wallet. The technique, named NullReceiver by the OpenSourceMalware research team and reported by The Hacker News, is the most recent case in a trend with a track record: malware's point of contact is moving onto the public blockchain.
The striking part is not the package itself — a few hundred downloads at most — but what it neutralises. For years the standard way to cut a campaign has been to take down the C2 domain or IP: file a request with the registrar, stand up a DNS sinkhole, block it at the firewall. NullReceiver has no registrar to petition. That shifts the burden of defence elsewhere.
NullReceiver hides the C2 IP inside the recipient field of a zero-value, zero-data Ethereum transfer. It uses no smart contract and no call data, which removes at a stroke the three signals that worked against its predecessor, EtherHiding.
It surfaced in two npm packages impersonating popular Tailwind CSS plugins, linked to the North Korean Contagious Interview campaign and to the second-stage credential stealer BeaverTail. At heart it is a supply chain attack with a novel command channel.
There is no domain and no server to seize: the operator rotates the C2 by broadcasting a fresh transfer for a few pennies. Leaning on domain takedown as the primary control no longer holds up for this class of threat.
A trail does remain. The reused wallet is a durable indicator of compromise, and a development machine querying an Ethereum node is a thoroughly detectable network anomaly.
Three signals of one trend
The technique has a genealogy you can date. In October 2023, Guardio Labs described EtherHiding: embedding malicious code in a smart contract on a public chain — BNB Smart Chain or Ethereum — and using it as a C2 no registrar can pull down, as BleepingComputer reported.
In October 2025, Google's Threat Intelligence Group documented that the North Korean cluster UNC5342 had adopted EtherHiding — the first time it attributed the technique to a nation-state actor — inside the Contagious Interview campaign, with a chain that ended by deploying an INVISIBLEFERRET variant to steal cryptocurrency.
And it is not only states: Google attributes to a financially motivated actor, UNC5142, the use of EtherHiding to distribute malware at scale. NullReceiver, in August 2026, pares the technique to the bone: it drops the smart contract and keeps only the bare minimum.
What NullReceiver does, conceptually
The loader bundled in the package — analysts tie it to the XORIndex Loader — makes an HTTPS JSON-RPC lookup against an Ethereum node. It requests the most recent outbound transactions for a fixed attacker wallet, takes the latest one and reads the recipient field. From those bytes it decodes an IPv4 address. No attack instruction travels in the package: only the logic to resolve where to connect.
With that IP, the loader fetches and runs BeaverTail, the staple Contagious Interview implant — a trojan that steals credentials and wallets, then stages the next hop. The supply chain is the envelope; the blockchain is just the address written inside it.
Researchers published concrete indicators: the packages bianira-ui (version 1.27.0, roughly 109 downloads) and fluid-type-ui (version 2.0.8, roughly 587 downloads), published on 28 July 2026 and since removed from npm; the attacker wallet, which begins 0xa322…ef1a; and the IP it resolved to at the time of analysis, 166.88.134.62, on ports 443 and 80, as GBHackers details. Treat them as what they are: a snapshot of one moment, most likely already rotated.
Why it is harder to see than EtherHiding
EtherHiding stored the payload inside a contract. To read it, the infected host made a read-only call to that contract, with call data and a fixed contract address. Each of those was a signal a defender could hunt for. NullReceiver removes all three: there is no contract to interact with, no call data, and the recipient changes with every rotation. Only a few bytes fit — just enough for an IPv4 — but that is plenty to resolve a C2. Stealth is bought at the cost of capacity, and the operator has decided the trade is worth it.
What changed in a year
Twelve months ago, an analyst could file blockchain C2 under laboratory curiosity. Today there are two publicly documented techniques, a state actor and a criminal one using them, and a variant — NullReceiver — that already optimises stealth over function. The volume is still small — few downloads — but the maturity is not: the technique looks to be evolving faster than the defences designed for it can adapt.
What it means for defensive architecture
If the control you trusted was identifying and blocking the C2 domain or IP, this class of threat leaves it limping. Not because blocking an IP stops working — the resolved IP can be blocked once known — but because the attacker rotates it in seconds and with no infrastructure of its own, and there is no intermediary, no registrar and no hosting provider, to go to and cut the channel at the root. The weight shifts to three fronts: egress telemetry, dependency provenance and governance of the developer endpoint.
Egress telemetry
That same traffic — an outbound JSON-RPC connection to a public Ethereum node from a build agent or a continuous integration runner — rarely has a legitimate explanation. Unless you build cryptocurrency software, it should not exist. An egress allowlist for build environments, plus a hunt rule that alerts on calls to blockchain RPC nodes from hosts that have no business talking to a chain, turn the attacker's stealth into a weakness. This is where a threat hunting function pays off more than any blocklist.
Dependency provenance
The packages impersonated well-known Tailwind CSS plugins: plausible names, recent versions, little history. The controls that reduce this are familiar and still hold: pin versions with lockfiles, run installs without automatic scripts (--ignore-scripts) and enable them only for reviewed dependencies, use an internal registry with an allowlist, and analyse package behaviour rather than signatures alone.
It is the same pattern we saw in the self-replicating npm worm that plants hooks in Claude Code and VS Code, in the jscrambler infostealer that hunts your AI tooling secrets and in the easy-day-js attack that trojanised 140-plus packages: what changes is where the attacker hides its point of contact, not how it gets in.
The developer endpoint as the way in
Contagious Interview does not exploit a software flaw: it persuades a developer to run a technical exercise during a fake recruitment process. The vector is social engineering aimed at the person, and what gets hit is their laptop, with access to repositories, tokens and deployments. Hardening that endpoint with behavioural EDR, plus a rule that no repository from a job assessment is opened on the work machine, closes the door before the blockchain ever comes into play.
What loses ground and what rises in priority
Leaning C2 detection mainly on lists of known malicious domains and IPs loses ground. It stays useful as a layer, but on its own it is no longer enough against a channel that reconfigures at will.
The priorities shift the other way: egress control in build and continuous integration, behavioural EDR on the endpoint, dependency provenance review, segmentation of the build environment, proactive hunting and third-party risk management. And a new, durable indicator appears: the on-chain wallet that — unlike a domain — cannot be taken down, but can be watched. This evolution is a sibling of the hidden C2 in Microsoft Teams used by DragonForce and fits the five supply-chain lessons for the CISO we have been flagging.
Small today, cheap to copy
Today this is small: a few hundred downloads and a handful of cases. What should worry defenders is the cost. Broadcasting an empty transfer costs pennies and needs no infrastructure of its own; that puts the technique within reach of almost any group, not just a state-backed one. Your telemetry should flag a build server that starts talking to Ethereum within minutes. The fair question is whether you are collecting it at all.
This article is based on public disclosures available in August 2026. The attribution to North Korea and to the Contagious Interview campaign comes from third-party analysis and may evolve over time; the indicators cited — wallet and IP — reflect the state at the date of analysis and have most likely already rotated.
The detection and containment measures described — egress control, dependency review and hunting for RPC anomalies — are indicative and should be validated in your own environment before use. This content is defensive reporting: it contains no attack code and no exploitation steps.
