Malware Uses Ethereum Wallet as C2 Dead Drop

Six npm packages have been caught using an attacker-controlled Ethereum wallet to find their next-stage servers, pulling command-and-control (C2) addresses straight out of a blockchain transaction. Sonatype Research Labs identified the packages on August 10 and published its analysis the same day, with all six carrying the same payload.

Blockchain Tradecraft

On execution, the loader queried Ethereum for an outbound transaction from the wallet and read bytes out of the transaction's recipient address. Those bytes decoded into two IPv4 addresses, which it treated as primary and secondary C2 endpoints.

Sonatype found this implementation more extensive than behavior previously documented. The loader could query several Ethereum remote procedure call providers, race requests between them, batch its calls, and fall back to the Blockscout API to locate the relevant transaction, giving it multiple routes to recover its infrastructure if one failed.

Hijacked vs. Purpose-Built

The six packages split evenly between hijacked packages and purpose-built ones. Three appeared to be legitimate packages whose publishing accounts were compromised: @kolbo/mcp, agentgui, and godot-kit.

In each, the original functionality remained intact and the loader was appended to the end of an existing file, which Sonatype noted matched behavior it observed in the DPRK-linked PolinRider campaign. The other three, envpack-conf, postcss-initial-provider, and tailwindcss-motion-advanced, were published with the malware already present, each wrapped in plausible functionality—one carried package-configuration code, another a working PostCSS plugin, and the third hid the loader inside a minified utility file.

Lazarus Connection

The wallet address matches one documented by researchers at OpenSourceMalware, who named the technique NullReceiver and attributed the activity they examined to the DPRK-linked Contagious Interview campaign, associated with the Lazarus group. Sonatype said it confirmed the wallet match and observed similar tradecraft, including package hijacking and blockchain-based retrieval of follow-on infrastructure.

Harder Detection Problem

Sonatype said the hijacked packages presented the harder detection problem, because the malicious code arrived through names developers may already recognize and trust. This approach exploits the trust that developers place in familiar libraries, making it more likely that the malicious code will be deployed without scrutiny.

Response and Mitigation

Teams should check their environments for the affected versions, remove them, and investigate for follow-on JavaScript execution or other signs of compromise. Sonatype said it is continuing to examine related npm activity.

Why It Matters

This technique suggests a shift toward more resilient C2 infrastructure, where attackers can hide their control servers in plain sight on a public blockchain. The use of Ethereum transactions as a dead drop could make it harder for defenders to block or take down C2 channels, raising the stakes for package managers and security teams alike.