Six npm packages have been found querying an attacker-controlled Ethereum wallet to work out where to fetch their next stage of malware, reading command-and-control (C2) addresses out of a blockchain transaction.
Sonatype Research Labs identified the packages on August 10 and published its analysis the same day. All six carry the same payload, and Sonatype is tracking them as sonatype-2026-005899 and sonatype-2026-005901.
The wallet address matches one documented by researchers at OpenSourceMalware, who named the technique NullReceiver and attributed the activity they examined to the DPRK-linked Contagious Interview campaign, associated with the Lazarus group.
Sonatype said it confirmed the wallet match and observed similar tradecraft, including package hijacking and blockchain-based retrieval of follow-on infrastructure.
Read more on npm supply chain attacks: North Korean Hackers Launch New Wave of npm Package Attacks
A Transaction as a Dead Drop
On execution, the loader queried Ethereum for an outbound transaction from the wallet and read bytes out of the transaction’s recipient address. Those bytes decoded into two IPv4 addresses, which it treated as primary and secondary C2 endpoints.
Sonatype found this implementation more extensive than the behavior previously documented. The loader could query several Ethereum remote procedure call providers, race requests between them, batch its calls and fall back to the Blockscout API to locate the relevant transaction, giving it multiple routes to recover its infrastructure if one failed.
Once resolved, it pulled two further stages from the server. If a standard request failed, it retried and recovered the payload from a response header instead.
The result was decoded and could either run directly inside the current Node.js process or launch as a detached child process.
Two Routes Into the Registry
The six split evenly between hijacked packages and purpose-built ones. Three appearED to be legitimate packages whose publishing accounts were compromised: @kolbo/mcp, agentgui and godot-kit.
In each, the original functionality remained intact and the loader was appended to the end of an existing file, which Sonatype noted matched behaviour it observed in the DPRK-linked PolinRider campaign.
The other three, envpack-conf, postcss-initial-provider and tailwindcss-motion-advanced, were published with the malware already present, each wrapped in plausible functionality. One carried package-configuration code, another a working PostCSS plugin and the third hid the loader inside a minified utility file.
Sonatype said the hijacked packages presented the harder detection problem, because the malicious code arrived through names developers may already recognize and trust.
Teams should check their environments for the affected versions, remove them and investigate for follow-on JavaScript execution or other signs of compromise. Sonatype said it is continuing to examine related npm activity.
