Malicious Payload Spotted in Six npm Packages Using Ethereum Blockchain

Sonatype Research Labs identified six npm packages that delivered the same malicious payload. The packages were either hijacked legitimate ones or newly published malware, all containing the same Ethereum wallet address.

The malware uses a technique called 'NullReceiver' to locate infrastructure hosting additional JavaScript payloads on the Ethereum blockchain. It retrieves two IPv4 addresses from an outbound transaction and treats them as primary and secondary command-and-control (C2) endpoints.

Researchers confirmed that all six packages use the same wallet address, which is associated with the DPRK-linked Contagious Interview campaign. The malicious payload was embedded into or shipped with package files in both hijacked and newly published packages.