NullReceiver hides command servers in Ethereum recipient addresses

Researchers have identified two trojanized npm packages, bianira-ui and fluid-type-ui, that use a blockchain-based command-and-control technique called NullReceiver. The packages were published on July 28, 2026, downloaded 109 and 587 times respectively, and have since been removed from npm. OpenSourceMalware linked the activity to North Korea.

NullReceiver stores a command-and-control server IP address in the recipient address of an otherwise empty Ethereum transfer. The approach is described as an evolution of EtherHiding, a technique first documented by Guardio Labs in October 2023 that placed malicious code in smart contracts on public blockchains.

Recipient address becomes the resolver

The affected JavaScript libraries contain a hard-coded attacker wallet, 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a. On an infected machine, the code retrieves that wallet's latest outbound transaction, reads its destination address, converts its first four bytes from hexadecimal to decimal values, and uses the result as a C2 IP address.

In the observed transactions, the destination was 0xa658863ea658863e68656c6c6f6970626f742121. Its first four bytes resolve to 166.88.134[.]62, while the trailing bytes decode to the ASCII text helloipbot!!. Researchers counted 68 transactions from July 27, one day before the packages appeared.

Why NullReceiver changes detection

EtherHiding can conceal a full URL or script in smart-contract data or transaction calldata, but it relies on a fixed, publicly known destination that defenders can monitor. NullReceiver does not call a smart contract or use calldata. It instead uses a made-up destination address solely as a container for a few encoded bytes.

OpenSourceMalware said each lookup uses a new, disposable destination address. That removes the fixed destination and payload field that could otherwise provide a consistent detection signal. Blank transfers also avoid calldata's per-byte gas cost, making the transaction shape cheaper and less conspicuous.

Software supply-chain implication

The campaign reinforces how package trust can be abused: borrowed trust tactics in cybersecurity offers a useful framing for the wider pattern, while this case shows that a seemingly ordinary JavaScript dependency can use blockchain data to obtain a live network destination. Registry removal limits new downloads, but does not remove code already installed in development or production environments.

Businesses should review newly introduced npm dependencies, inspect packages with limited publisher history, and assess runtime code that queries blockchain transactions before opening network connections. Detection should account for dependency code that derives destinations dynamically rather than containing a conventional hard-coded C2 address.