Six npm packages have been identified that query an Ethereum wallet to retrieve command-and-control (C2) server addresses, a technique that leverages blockchain transactions as a dead drop for malware infrastructure. Sonatype Research Labs discovered these packages on August 10 and published their findings the same day, tracking them under identifiers sonatype-2026-005899 and sonatype-2026-005901.
The Ethereum wallet address involved in this activity matches one previously documented by OpenSourceMalware researchers, who named the technique "NullReceiver" and linked it to the "Contagious Interview" campaign, which is associated with the DPRK-linked Lazarus group. Sonatype confirmed this wallet match and noted similar tradecraft, including package hijacking and the use of blockchain for retrieving follow-on infrastructure.
Upon execution, the malicious loader queries the Ethereum blockchain for an outbound transaction from the specified wallet. It then extracts bytes from the transaction's recipient address, which decode into two IPv4 addresses designated as primary and secondary C2 endpoints. This implementation is more sophisticated than previously documented behaviors, as the loader can query multiple Ethereum remote procedure call providers, batch requests, and fall back to the Blockscout API, ensuring multiple routes to recover its infrastructure.
Once the C2 addresses are resolved, the loader pulls two additional stages of malware from the server. If a standard request fails, it retries and recovers the payload from a response header. The decoded result can either execute directly within the current Node.js process or launch as a detached child process.
The six malicious packages are divided equally between hijacked legitimate packages and newly created, purpose-built ones. Three packages—@kolbo/mcp, agentgui, and godot-kit—appear to be legitimate packages whose publishing accounts were compromised. In these instances, the original functionality remained intact, with the loader appended to an existing file, a method observed in the DPRK-linked "PolinRider" campaign.
The other three packages—envpack-conf, postcss-initial-provider, and tailwindcss-motion-advanced—were published with the malware already embedded. Each of these new packages was wrapped in plausible functionality, such as package-configuration code, a working PostCSS plugin, or a minified utility file. Sonatype noted that the hijacked packages pose a greater detection challenge because they leverage names that developers may already recognize and trust.
Organizations are advised to check their environments for the affected versions of these packages, remove them, and investigate for any signs of follow-on JavaScript execution or other indicators of compromise. Sonatype continues to monitor related npm activity.
