Researchers have discovered two trojanized npm packages using a novel command-and-control evasion technique that embeds attacker IP addresses within fake Ethereum blockchain transactions.
The packages, "bianira-ui" and "fluid-type-ui," employ the NullReceiver tactic, an evolution of the earlier EtherHiding method. The technique works by encoding C2 server addresses into the destination field of empty Ethereum transfers. This approach hides malicious infrastructure inside blockchain data, making traditional network monitoring and IP-based blocking significantly harder to execute.
The EtherHiding technique, while not new, has proven effective at evading detection. Attackers send zero-value transactions to nonsense Ethereum addresses, embedding C2 coordinates in the recipient field itself. The trojanized npm packages decode these blockchain transactions at runtime, retrieving the actual C2 server IP without ever hardcoding infrastructure details into the package code. This creates a dead drop resolver pattern where the blockchain acts as a decentralized bulletin board.
npm packages reach developers through legitimate dependency chains, making this supply chain attack particularly dangerous. Developers who installed "bianira-ui" or "fluid-type-ui" likely did so without knowing the packages contained malware. Once installed, the packages execute code that queries Ethereum's public blockchain, extracts C2 addresses, and establishes connections to attacker-controlled servers.
The risk extends beyond individual developers to organizations relying on these packages in production systems. Compromised dependencies can steal credentials, inject backdoors, exfiltrate source code, or establish persistent access for later exploitation. The use of blockchain as a C2 channel complicates incident response because defenders cannot simply block IP ranges. The malicious infrastructure remains dynamic and distributed across an immutable ledger.
npm has removed both packages, but the threat demonstrates how attackers continue