Cybersecurity researchers have flagged an evolution of the EtherHiding blockchain-based command-and-control (C2) technique that conceals the C2 server IP address inside a made-up destination address of a completely empty Ethereum transfer.
The new dead drop resolver approach, observed in two trojanized npm packages “bianira-ui” and “fluid-type-ui,” has been codenamed NullReceiver by OpenSourceMalware, which has described it as a “deliberate improvement on EtherHiding.” The activity has been linked to North Korea.
The packages are currently no longer available for download from npm. However, statistics show that they have been downloaded a few hundred times since they were first published on July 28, 2026 –
- bianira-ui (109 downloads), uploaded by an npm user named “npmuser1101”
- fluid-type-ui (587 downloads), uploaded by an npm user named “npmuser3002”
EtherHiding was first publicly documented by Guardio Labs in October 2023 as a covert approach that involves embedding nefarious code within a smart contract on a public blockchain like BNB Smart Chain (BSC) or Ethereum. The technique heralded the “next level of bulletproof hosting” as it improves operational resilience in the face of takedowns.
The use of EtherHiding by North Korean hacking groups was detailed by Google Threat Intelligence Group (GTIG) late last year in connection with Contagious Interview, a long-running campaign that aims to deceive potential targets by approaching them on LinkedIn with lucrative job opportunities and asking them to complete an assessment that leads to malware deployment.
The latest development indicates that the threat actors are further refining their tactics and making it difficult for defenders to detect.
“Instead of hardcoding a C2 address or hiding it in transaction calldata (as in EtherHiding), NullReceiver encodes the C2 IP directly in the bytes of the recipient address of a zero-value, zero-data Ethereum transfer,” security researcher Paul McCarty said.
“The malware looks up the attacker’s wallet, reads the destination address of its most recent outbound transaction, and decodes a C2 IP straight from those address bytes, with no smart contract and no payload field involved.”
By embedding the C2 IP address in this manner, NullReceiver aims to address one of the major shortcomings of EtherHiding, which requires a fixed, publicly known destination address — one that can be tracked by defenders as new transactions containing the payload, the C2 IP address, or the malicious script, occur for a gas fee.
NullReceiver, in contrast, provides a non-existent destination address. The address “exists” only to provide a way to encode the C2 IP address within itself. This, in turn, makes attribution difficult, as it eliminates the “fixed, watchable destination.”
Neither of the newly discovered npm packages identified as part of the new campaign, bianira-ui and fluid-type-ui, calls a smart contract nor embeds any content within the transaction’s calldata field. Instead, the JavaScript libraries leverage the new technique to extract the IP address and connect to it. The entire sequence of actions on a victim machine is as follows –
- Look up a hard-coded attacker wallet (“0xa322e5f3d311d3080e6f0121063e9adc2490ef1a“)
- Find its most recent outbound transaction
- Read that transaction’s destination address
- Decode a C2 IP address directly out of the address bytes by converting the first four bytes from their hexadecimal representation to their number equivalent
- Connect to that IP address (“166.88.134[.]62”)
An examination of the wallet transactions shows that the destination “To” address for each of them is the same: “0xa658863ea658863e68656c6c6f6970626f742121.” While “a658863e” becomes “166.88.134[.]62,” the trailing bytes “68656c6c6f6970626f742121” represent the ASCII string “helloipbot!!.”
As of writing, a total of 68 transactions have taken place since July 27, 2026, a day before the packages were published.
What makes NullReceiver more sneaky is the absence of a fixed target and a fingerprint, not to mention the fact that the transactions are cheaper than before. A crucial difference between the two techniques is that while EtherHiding makes it possible to smuggle a full URL or script, NullReceiver can only encode a few bytes.
“NullReceiver never reuses a destination,” OpenSourceMalware said. “Every lookup is a brand-new, throwaway address that’s never been seen before. A NullReceiver transaction carries nothing extra at all. There’s no field to fingerprint, because there’s no field.”
“Calldata costs gas per byte. EtherHiding pays for that. NullReceiver’s transfer is completely blank, making it the cheapest, least conspicuous transaction shape on the network.”
Update
OpenSourceMalware said it identified an additional set of five packages using the NullReceiver technique. These are listed below –
- post-css-transfer (318 downloads)
- scrollbar-hide-plugin (247 downloads)
- tailwind-anim (1,301 downloads)
- tailwind-animation-founder (124 downloads)
- tailwindcss-anim (1,357 downloads)
Jenn Gile, co-founder of OpenSourceMalware, told The Hacker News that there are definite signs of cryptocurrency wallet reuse from North Korean threat actors, which made it possible to connect the newly discovered npm packages with existing campaigns.
The shared infrastructure has also led to the discovery of more than 20 other compromised packages across the npm, Go, PHP ecosystems that are linked to another campaign tracked as PolinRider.
“PolinRider has spent at least five months getting into thousands of developer machines any way it can: fake interviews, poisoned forks, malicious VS Code tasks, typosquatted packages,” Gile said. “DPRK’s goal is to compromise developer machines and accounts to silently propagate malicious code, clone repositories, and push backdoored commits without active human intervention.”
(The story has been updated after publication on August 6, 2026, to include additional insights from OpenSourceMalware.)
