Six npm packages have recently been discovered engaging with an attacker-controlled Ethereum wallet in order to determine where to retrieve their next stage of malware from, extracting command-and-control (C2) addresses from a blockchain transaction.
The findings were made public by Sonatype Research Labs on August 10, who identified the six packages and published their analysis on the same day. These packages, tracked as sonatype-2026-005899 and sonatype-2026-005901, all contain the same malicious payload.
Researchers at OpenSourceMalware had previously documented a wallet address linked to the DPRK-associated Contagious Interview campaign, known as NullReceiver. Sonatype confirmed this connection and noted similar tactics such as package hijacking and utilizing blockchain transactions to fetch additional infrastructure.
Upon execution, the loader in these packages queries the Ethereum network for a specific outbound transaction from the controlled wallet, extracting bytes from the recipient address. These bytes are decoded into two IPv4 addresses, serving as primary and secondary C2 endpoints. Sonatype observed that this implementation was more sophisticated than previous instances, as the loader could interact with multiple Ethereum RPC providers, batch requests, and fallback to the Blockscout API for transaction retrieval.
Following the retrieval of C2 endpoints, the loader proceeds to fetch two additional stages from the server. In case of failures, it retries requests and retrieves payloads from response headers. The decoded payload can either run within the current Node.js process or as a detached child process.
The six packages were divided into two categories: hijacked packages and purpose-built ones. Three packages, including @kolbo/mcp, agentgui, and godot-kit, appeared to be legitimate but had their publishing accounts compromised. The remaining three, envpack-conf, postcss-initial-provider, and tailwindcss-motion-advanced, were published with the malware already embedded, disguised as legitimate functionality.
Sonatype highlighted the challenges in detecting hijacked packages, as developers may unknowingly trust these familiar names. Organizations are advised to check for affected versions, remove them, and investigate for any signs of compromise or malicious JavaScript execution. Sonatype continues to monitor related npm activities for further insights.