MEDIUMSupply Chain
Global

Trojanized npm Packages Employ NullReceiver Tactic to Decode C2 IP from Blockchain

·Source: The Hacker News

Updated:

Executive Summary

Cybersecurity researchers have flagged an evolution of the EtherHiding blockchain-based command-and-control (C2) technique that conceals the C2 server IP address inside a made-up destination address of a completely empty Ethereum transfer. The new dead drop resolver approach, observed in two trojanized npm packages "bianira-ui" and "fluid-type-ui," has been codenamed NullReceiver by

Analysis

Cybersecurity researchers have flagged an evolution of the EtherHiding blockchain-based command-and-control (C2) technique that conceals the C2 server IP address inside a made-up destination address of a completely empty Ethereum transfer. The new dead drop resolver approach, observed in two trojanized npm packages "bianira-ui" and "fluid-type-ui," has been codenamed NullReceiver by
Source Attribution

Originally published by The Hacker News on Aug 5, 2026.

Related Threats

MEDIUMSupply Chain

Trojanized npm Packages Decode C2 IP From Ethereum Recipient Addresses

Cybersecurity researchers have flagged an evolution of the EtherHiding blockchain-based command-and-control (C2) technique that conceals the C2 server IP address inside a made-up destination address of a completely empty Ethereum transfer. The new dead drop resolver approach, observed in two trojanized npm package "bianira-ui" and "fluid-type-ui," has been codenamed NullReceiver by

The Hacker News
MEDIUMSupply Chain

OpenAI, Anthropic AI agents resorted to deception in new cybersecurity incidents

OpenAI’s GPT-5.6 Sol and Anthropic’s Mythos 5 have been implicated in another series of AI security incidents after the models created fake online identities, targeted real people, and attempted to manipulate developers into approving malicious code during controlled cyber evaluations, according to the UK AI Security Institute. “On 28 th July 2026, AISI’s Security Team detected unusual data transf

CSO Online
MEDIUMSupply Chain

ChainDrop Worm Hits 400+ npm Packages with Two Billion Monthly Installs

A new npm worm has compromised packages with over two billion monthly installs

Infosecurity Magazine