"Instead of hardcoding a C2 address or hiding it in transaction calldata (as in EtherHiding), NullReceiver encodes the C2 IP directly in the bytes of the recipient address of a zero-value, zero-data Ethereum transfer," security researcher Paul McCarty said.
NullReceiver: a one-line innovation that hides a server IP
OpenSourceMalware has given a name to a newly observed refinement of blockchain-based command-and-control: NullReceiver. The technique encodes a command-and-control (C2) IP address inside the recipient address field of an otherwise empty Ethereum transfer. According to the researchers, NullReceiver removes the need for a smart contract or transaction calldata by placing the address bytes themselves under the microscope.
How the trojanized npm packages used NullReceiver
Two trojanized npm packages—bianira-ui and fluid-type-ui—implemented the NullReceiver resolver. Neither package calls a smart contract nor embeds content in a transaction's calldata field. Instead, the JavaScript libraries perform a short sequence of actions on an infected host: look up a hard-coded attacker wallet ("0xa322e5f3d311d3080e6f0121063e9adc2490ef1a"), find its most recent outbound transaction, read that transaction's destination address, convert the first four bytes of that address from hex into a number to obtain an IP, and connect to that IP. The reported decoded address is "166.88.134[.]62."
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleEvidence on-chain: wallet, transactions, and the encoded message
Examination of the attacker's wallet transactions shows a repeated pattern. The destination "To" address for each outbound transaction from the wallet is the same: "0xa658863ea658863e68656c6c6f6970626f742121." The first four bytes, "a658863e," convert to the numeric IP shown above. The trailing bytes "68656c6c6f6970626f742121" correspond to the ASCII string "helloipbot!!." As of writing, OpenSourceMalware reported that a total of 68 transactions have taken place since July 27, 2026—one day before the two packages were published.
Trojanized packages, download counts, and attribution
The two malicious packages were published on July 28, 2026 and subsequently removed from npm; they remain unavailable for download. npm download statistics cited in the analysis show bianira-ui was downloaded 109 times and had been uploaded by an npm user named "npmuser1101." fluid-type-ui was downloaded 587 times and had been uploaded by an npm user named "npmuser3002." OpenSourceMalware described NullReceiver as a "deliberate improvement on EtherHiding," and the activity has been linked to North Korea.
Why NullReceiver changes the defender's playbook
- Minimal transaction footprint: OpenSourceMalware pointed out that NullReceiver transactions are zero-value, zero-data transfers—"completely blank"—and therefore cheaper and less conspicuous than the calldata-bearing transactions used in EtherHiding. "Calldata costs gas per byte. EtherHiding pays for that. NullReceiver's transfer is completely blank, making it the cheapest, least conspicuous transaction shape on the network," the researchers said.
- No fixed, watchable destination: EtherHiding depended on a fixed, publicly known destination address that defenders could track as payloads or C2 information appeared. NullReceiver intentionally uses a non-existent, throwaway destination address for each lookup—"never reuses a destination"—so there is no persistent, fingerprintable target to watch on-chain, OpenSourceMalware said.
- Tradeoffs in capability: The analysis notes a capability tradeoff. EtherHiding could smuggle larger payloads—full URLs or scripts—because it used calldata or smart contracts; NullReceiver can only encode a few bytes (sufficient for an IPv4 address and short marker text), but it gains lower cost and greater stealth.
What this means for technologists, policymakers, and open-source maintainers
- Technologists and security teams: defenders face a pattern where the C2 pointer is derived from ephemeral, single-use destination addresses rather than a fixed on-chain target. Security teams will need telemetry that links suspicious outbound package behavior to the on-chain transactions of a hard-coded wallet address, and to examine address bytes—not only calldata—for hidden signals.
- Policymakers and regulators: public blockchain transactions are being repurposed to communicate operational details for malware with an eye toward resilience against takedown. That fact—documented here as a refinement of an already-published technique—underscores an emerging use of public ledgers in malicious tradecraft that regulators and policy-makers may need to consider when evaluating responses to cross-border abuse.
- Open-source maintainers and package consumers: two npm packages were trojanized, published, downloaded several hundred times, and later removed. The incident underlines the exposure created when widely distributed libraries contain hard-coded wallet identifiers that can be used as live lookup points for off-chain communications.
NullReceiver represents a small technical change with outsized operational effect: by moving the signal into the recipient address of a blank transfer, the actors traded payload size for lower cost and a near-disappearing on-chain fingerprint. The reporting ties this refinement to a pattern first described as EtherHiding by Guardio Labs in October 2023 and to prior use by North Korean-linked actors, as documented by the Google Threat Intelligence Group in connection with the Contagious Interview campaign. The concrete questions now are narrow and urgent—how defenders will reliably connect package behavior to on-chain throwaway addresses, and how responders will track a technique designed expressly to leave no fixed on-chain trail.
