~/article/trojanized-npm-packages-employ-nullreceiver-tactic-to-decode-c2-ip-from-99tpp1

info2026-08-05 13:41 UTCSource: The Hacker News

Trojanized npm Packages Employ NullReceiver Tactic to Decode C2 IP from Blockchain

Cybersecurity researchers have flagged an evolution of the EtherHiding blockchain-based command-and-control (C2) technique that conceals the C2 server IP address inside a made-up destination address of a completely empty Ethereum transfer. The new dead drop resolver approach, observed in two trojanized npm packages "bianira-ui" and "fluid-type-ui," has been codenamed NullReceiver by

Read at the source

Summary written for cymesh.dev. The full article lives at The Hacker News.

Topics

supply-chain malware

~/cymesh.net

Certificates expire quietly

cymesh.net watches your TLS and SSL certificates and warns you before one lapses.

monitorsTLS/SSL expiry, chain and hostnamealertsemail, ahead of the expiry datescopenon-intrusive, read-only checks

Talk to us See cymesh.net

~/related/trojanized-npm-packages-employ-nullreceiver-tactic-to-decode-c2-ip-from-99tpp1

2026-10-06 21:00 UTC[med]

Trojanized npm Packages Employ NullReceiver Tactic to Decode C2 IP from Blockchain

Topics

Certificates expire quietly

Related

Ninja Forms plugin flaw exploited to hack WordPress sites

Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan

Alleged ATM malware creator appears in Nebraska court after arrest

ClickFix campaign in Ukraine compromises over 100 websites to spread Lunex malware

FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM Malware

Long-Running NPM Malware Campaign Accumulates 40,000 Downloads