Trojanized npm Packages Decode C2 IP From Ethereum Recipient Addresses

Two trojanized npm packages ('bianira-ui' and 'fluid-type-ui') implement a new blockchain-based dead drop resolver technique called NullReceiver, which is an evolution of the EtherHiding C2 concealment method. Instead of embedding C2 server information in smart contract calldata or transaction payloads, NullReceiver encodes the C2 IP address directly within the bytes of the recipient (destination) address of a zero-value, zero-data Ethereum transfer. The malware looks up a hard-coded attacker wallet address (0xa322e5f3d311d3080e6f0121063e9adc2490ef1a), retrieves the most recent outbound transaction, reads the destination address, and decodes the C2 IP by converting the first four bytes from hexadecimal to decimal notation. For example, the destination address '0xa658863ea658863e68656c6c6f6970626f742121' yields the C2 IP '166.88.134[.]62' from the first four bytes 'a658863e', while trailing bytes '68656c6c6f6970626f742121' decode to the ASCII string 'helloipbot!!'. This approach eliminates the need for smart contracts and calldata, making transactions cheaper, harder to fingerprint, and resistant to takedowns. Every lookup uses a brand-new throwaway destination address, eliminating fixed, watchable targets. The packages were published on July 28, 2026, with 68 transactions recorded since July 27, 2026. The campaign is linked to North Korea's Contagious Interview operation, which uses LinkedIn job lures to trick targets into executing malware.