Six npm Packages Read C2 Addresses From Ethereum Wallet

Six npm packages have been found querying an attacker-controlled Ethereum wallet to work out where to fetch their next stage of malware, reading command-and-control (C2) addresses out of a blockchain transaction.

Sonatype Research Labs identified the packages on August 10 and published its analysis the same day. All six carry the same payload, and Sonatype is tracking them as sonatype-2026-005899 and sonatype-2026-005901.

The wallet address matches one documented by researchers at OpenSourceMalware, who named the technique NullReceiver and attributed the activity they examined to the DPRK-linked Contagious Interview campaign, associated with the Lazarus group. 

Sonatype said it confirmed the wallet match and observed similar tradecraft, including package hijacking and blockchain-based retrieval of follow-on infrastructure.

A Transaction as a Dead Drop

On execution, the loader queried Ethereum for an outbound transaction from the wallet and read bytes out of the transaction's recipient address. Those bytes decoded into two IPv4 addresses, which it treated as primary and secondary C2 endpoints.

Sonatype found this implementation more extensive than the behavior previously documented. The loader could query several Ethereum remote procedure call providers, race requests between them, batch its calls and fall back to the Blockscout API to locate the relevant transaction, giving it multiple routes to recover its infrastructure if one failed.

Once resolved, it pulled two further stages from the server. If a standard request failed, it retried and recovered the payload from a response header instead.

The result was decoded and could either run directly inside the current Node.js process or launch as a detached child process.