Read more on npm supply chain attacks: North Korean Hackers Launch New Wave of npm Package Attacks
A Transaction as a Dead Drop
On execution, the loader queried Ethereum for an outbound transaction from the wallet and read bytes out of the transaction's recipient address. Those bytes decoded into two IPv4 addresses, which it treated as primary and secondary C2 endpoints.
Sonatype found this implementation more extensive than the behavior previously documented. The loader could query several Ethereum remote procedure call providers, race requests between them, batch its calls and fall back to the Blockscout API to locate the relevant transaction, giving it multiple routes to recover its infrastructure if one failed.
Once resolved, it pulled two further stages from the server. If a standard request failed, it retried and recovered the payload from a response header instead.
The result was decoded and could either run directly inside the current Node.js process or launch as a detached child process.
Two Routes Into the Registry
The six split evenly between hijacked packages and purpose-built ones. Three appearED to be legitimate packages whose publishing accounts were compromised: @kolbo/mcp, agentgui and godot-kit.
In each, the original functionality remained intact and the loader was appended to the end of an existing file, which Sonatype noted matched behaviour it observed in the DPRK-linked PolinRider campaign.
The other three, envpack-conf, postcss-initial-provider and tailwindcss-motion-advanced, were published with the malware already present, each wrapped in plausible functionality. One carried package-configuration code, another a working PostCSS plugin and the third hid the loader inside a minified utility file.
Sonatype said the hijacked packages presented the harder detection problem, because the malicious code arrived through names developers may already recognize and trust.
Teams should check their environments for the affected versions, remove them and investigate for follow-on JavaScript execution or other signs of compromise. Sonatype said it is continuing to examine related npm activity.
