npm developers (JavaScript/Tailwind CSS package users) · 2026-08-02
OpenSourceMalware researcher Paul McCarty identifies "NullReceiver," a technique embedding C2 IP addresses in zero-value Ethereum transaction recipients used by trojanized npm packages linked to North Korea. [Date Occurred: 28/07/2026; Date Discovered: 28/07/2026]
Six npm Packages Use Ethereum Transactions to Retrieve Malicious Payloads (NullReceiver / Contagious Interview) · 2026-08-10T16:02:45.000Z
Sonatype researchers confirmed the six packages use the same Ethereum wallet address in recent activity attributed to the DPRK-linked Contagious Interview campaign. OpenSourceMalware dubbed the specific blockchain-based command-and-control technique "NullReceiver," while Contagious Interview refers to the broader campaign associated with the Lazarus APT group.