Two trojanized npm packages tied to North Korea’s “Contagious Interview” campaign find their command server by reading it out of a blank Ethereum transfer, researchers at OpenSourceMalware reported over the weekend. They named the technique NullReceiver and called it a deliberate improvement on EtherHiding.
The packages, [email protected] and [email protected], are clones of legitimate Tailwind CSS plugins. “Instead of hardcoding a C2 address or hiding it in transaction calldata (as in EtherHiding), NullReceiver encodes the C2 IP directly in the bytes of the recipient address of a zero-value, zero-data Ethereum transfer,” the researchers wrote. The malware looks up the attacker’s wallet, takes its most recent outbound transaction and decodes the IP from the destination address, with no smart contract and no payload field involved.
In the transaction OpenSourceMalware recovered, the attacker wallet 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a sent nothing to the made-up address 0xa658863ea658863e68656c6c6f6970626f742121. Its bytes decode to the C2 IP 166.88.134.62, and the trailing bytes spell out the ASCII string “helloipbot!!”. The code queries public RPC endpoints at 1rpc.io and eth.drpc.org to do the lookup. The researchers said they did not run the packages and worked only from static analysis and read-only blockchain lookups.
EtherHiding, which Google Threat Intelligence tied to a North Korea-linked actor in October 2025, sends transactions to Ethereum’s well-known burn address and hides the payload in the calldata. That fixed destination is how Google’s team caught it. “NullReceiver never reuses a destination,” OpenSourceMalware wrote. “A NullReceiver transaction carries nothing extra at all. There’s no field to fingerprint, because there’s no field.” A blank transfer is also the cheapest kind of transaction, since calldata is billed per byte.
The trade-off is capacity. EtherHiding can carry a full URL or script, while NullReceiver encodes only a few bytes, making it closer to a hidden beacon than a delivery channel. Both still reuse the sending wallet across a campaign, so defenders can watch it once it is known. The researchers expect NullReceiver, or something close to it, to become the default blockchain dead drop in future North Korean npm campaigns, and advised teams whose detections look for malware talking to a smart contract to also check where transfers are supposedly going.
WebProNews is an iEntry Publication