Trojanized npm Packages Employ NullReceiver Tactic to Decode C2 IP from Blockchain

Cybersecurity researchers have flagged an evolution of the EtherHiding blockchain-based command-and-control (C2) technique that conceals the C2 server IP address inside a made-up destination address of a completely empty Ethereum transfer. The new dead drop resolver approach, observed in two trojanized npm packages "bianira-ui" and "fluid-type-ui," has been codenamed NullReceiver by

The article reports that DPRK-linked threat actors trojanized two npm packages, "bianira-ui" and "fluid-type-ui," to deploy a new blockchain-based C2 resolution technique called NullReceiver, which encodes the command server IP inside the recipient address of a zero-value, zero-data Ethereum transfer rather than using smart contracts or traditional payload fields.[1][2][3] This is part of a broader software supply chain threat pattern targeting JavaScript ecosystems, where malicious logic is hidden in dependencies and activated on developer or end-user environments.[3][6] From a RealGround perspective, this demonstrates that AI agents and AI-powered developer tooling consuming npm ecosystems are exposed to subtle supply chain compromises and covert C2 channels, making SBOM-driven dependency governance and blockchain-aware threat monitoring critical. Organizations using AI-assisted build, code generation, or autonomous agents to manage dependencies should enforce strict registry scoping, automated SBOM scanning, and continuous red-teaming of agent workflows to detect malicious packages and unusual external resolution mechanisms before they influence AI models or production systems.