npm Packages Caught Fetching Malware From Attacker-Controlled Wallet

Npm Package Attacks Escalate With Six Malicious Packages Found

Sonatype Research Labs identified six npm packages on August 10 that query an attacker-controlled Ethereum wallet to fetch their next stage of malware. The packages, tracked as sonatype-2026-005899 and sonatype-2026-005901, carry the same payload and have been linked to the DPRK-linked Contagious Interview campaign.

The malicious code reads command-and-control (C2) addresses from a blockchain transaction, giving it multiple routes to recover its infrastructure if one failed. The loader can query several Ethereum remote procedure call providers, batch its calls, and fall back to the Blockscout API to locate the relevant transaction.

The six packages split evenly between hijacked and purpose-built ones, with three appearing to be legitimate packages whose publishing accounts were compromised. Sonatype noted that the hijacked packages presented a harder detection problem due to their familiar names.