Cybersecurity researchers have discovered a new method for concealing command-and-control server addresses inside the recipient field of empty Ethereum transactions, a technique observed in two malicious npm packages that were downloaded nearly 700 times before being removed. The approach, which OpenSourceMalware has named NullReceiver, represents what the firm describes as a "deliberate improvement" over an earlier blockchain-hiding method called EtherHiding. The activity has been traced to North Korea.

The two packages—bianira-ui with 109 downloads and fluid-type-ui with 587 downloads—were first uploaded to npm on July 28, 2026, by user accounts npmuser1101 and npmuser3002. Statistics show the libraries remained available for download until they were recently pulled from the registry. OpenSourceMalware later identified five additional packages using the same technique: post-css-transfer (318 downloads), scrollbar-hide-plugin (247 downloads), tailwind-anim (1,301 downloads), tailwind-animation-founder (124 downloads), and tailwindcss-anim (1,357 downloads). Analysis of the attacker's Ethereum wallet shows 68 transactions took place starting July 27, 2026, one day before the packages went live. Each transaction used the same destination address, "0xa658863ea658863e68656c6c6f6970626f742121," where the first four bytes decode to the IP address 166.88.134[.]62 and the trailing bytes spell out "helloipbot!!" in ASCII.

"Instead of hardcoding a C2 address or hiding it in transaction calldata (as in EtherHiding), NullReceiver encodes the C2 IP directly in the bytes of the recipient address of a zero-value, zero-data Ethereum transfer," security researcher Paul McCarty explained. According to OpenSourceMalware, "NullReceiver never reuses a destination. Every lookup is a brand-new, throwaway address that's never been seen before." The firm noted that because the transactions carry no extra data, "there's no field to fingerprint, because there's no field," making each transfer cheaper and less detectable than EtherHiding transactions, which must pay gas fees for every byte of hidden payload.

The evolution addresses a core weakness in EtherHiding, which debuted in October 2023 and required a fixed, publicly known destination address that defenders could monitor for new transactions. NullReceiver eliminates that watchable target by generating a fresh, nonexistent address for each lookup—the address serves only as a container for the encoded IP, never receiving funds or existing as a real wallet. Google Threat Intelligence Group linked EtherHiding to North Korea's Contagious Interview campaign late last year, in which hackers pose as recruiters on LinkedIn and trick developers into running malware disguised as coding assessments. Jenn Gile, co-founder of OpenSourceMalware, told The Hacker News that wallet reuse by North Korean actors allowed researchers to connect the new packages to an existing campaign called PolinRider, which has spent at least five months infiltrating developer machines through fake interviews, poisoned code forks, malicious VS Code tasks, and typosquatted packages across npm, Go, and PHP ecosystems. The shared infrastructure led to the discovery of more than 20 other compromised packages tied to the same operation. Gile said North Korea's goal is to compromise developer accounts and machines "to silently propagate malicious code, clone repositories, and push backdoored commits without active human intervention." The shift to NullReceiver marks a continued push by state-sponsored groups to refine blockchain-based infrastructure that's resistant to takedowns and harder for defenders to track. Organizations relying on open-source dependencies face mounting pressure to audit supply chains at the transaction level, not just at the package registry.