Six npm packages were found querying an attacker-controlled Ethereum wallet to determine where to fetch follow-on malware, Sonatype Research Labs reported on August 10. The company published its analysis the same day and is tracking the finding as sonatype-2026-005899 and sonatype-2026-005901.
August 10 discovery by Sonatype Research Labs
Sonatype Research Labs identified six malicious npm packages on August 10 and released an analysis of their behavior that day. The packages all carried the same loader payload. Sonatype confirmed that the wallet address the loader queried matched a wallet previously documented by researchers at OpenSourceMalware, who called the technique NullReceiver and attributed the activity they examined to the DPRK-linked Contagious Interview campaign associated with the Lazarus group. Sonatype said it observed similar tradecraft, including package account hijacking and blockchain-based retrieval of follow-on infrastructure.
A transaction as a dead drop: how the loader resolves C2
On execution, the malicious loader queried the Ethereum blockchain for an outbound transaction from the attacker-controlled wallet and read bytes from the transaction's recipient address. Those bytes decoded into two IPv4 addresses, which the loader treated as primary and secondary command-and-control (C2) endpoints. Once it resolved those endpoints, the loader fetched two further stages from the server it discovered.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleImplementation details: redundancy and stealth in the retrieval chain
Sonatype found the loader's implementation to be more extensive than prior documentation. The code could query several Ethereum remote procedure call (RPC) providers, race requests between them, and batch calls—giving the loader multiple routes to recover its infrastructure if a single provider failed. If blockchain lookups failed, the loader could fall back to the Blockscout API to locate the relevant transaction. When a standard HTTP request for the next-stage payload failed, the loader retried and could recover the payload from an HTTP response header instead. The decoded result could either execute directly inside the current Node.js process or spawn a detached child process.
Two routes into the npm registry: hijacked accounts and purpose-built lures
The six malicious packages split evenly between compromised legitimate packages and purpose-built malicious uploads. Sonatype identified three packages that appear to have been legitimate but had their publishing accounts compromised: @kolbo/mcp, agentgui and godot-kit. In each of those, the original functionality remained intact and the loader was appended to the end of an existing file—a pattern Sonatype noted matched behavior previously observed in the DPRK-linked PolinRider campaign. The other three packages—envpack-conf, postcss-initial-provider and tailwindcss-motion-advanced—were published with malware already present, each wrapped in plausible functionality: one carried package-configuration code, another a working PostCSS plugin, and the third hid the loader inside a minified utility file. Sonatype warned that hijacked packages present a harder detection problem because the malicious code arrives through names developers may already recognize and trust.
What this means for technologists, open-source maintainers, and enterprises
- Technologists and security teams: Sonatype advised teams to check their environments for the affected package versions, remove any matches, and investigate for follow-on JavaScript execution or other signs of compromise.
- Open-source maintainers: The incident highlights the risk of compromised publishing accounts; packages where original functionality remains intact can carry appended loaders that evade casual inspection.
- Enterprises and procurement leaders: Because the malicious code was distributed both via hijacked, familiar package names and plausible new packages, dependency review and runtime detection will be important to identify any deployed instances.
Sonatype said it is continuing to examine related npm activity. The combination of blockchain-based “dead drops,” multiple RPC-provider routing, fallback APIs and header-based payload recovery shows an attacker optimizing for resilience and stealth. For teams that consume Node.js packages, Sonatype’s immediate instruction is straightforward: locate, remove, and investigate.
