NullReceiver: How Trojanized npm Packages Steal C2 IPs via Fake Ethereum Transfers

Introduction

In the world of open‑source software, npm packages are the lifeblood of countless projects. Recent investigations have uncovered a chilling new variant of command‑and‑control (C2) infrastructure that hijacks the Ethereum blockchain to hide malicious instructions. Dubbed “NullReceiver,” this technique leverages trojanized npm modules to embedParsed C2 server IPs in seemingly innocuous Ethereum transfer addresses. The result? A stealthy, blockchain‑based dead‑drop that evades many traditional detection mechanisms.

In this article we break down how NullReceiver works, why it’s a serious threat to developers and security teams, and what practical steps you can take to protect your supply chain and infrastructure.

The Threat Landscape: npm Trojanization Meets Blockchain C2

• npm as a vector: The vast ecosystem of npm packages makes them attractive targets for supply‑chain attacks.
• Blockchain as a hiding place: The immutability and global reach of public blockchains provide a reliable channel for data exfiltration.
• Dead‑drop resolvers: Attackers use smart contract calls or transaction Sevilla to deliver hidden instructions to compromised hosts.

NullReceiver: The New Dead‑Drop Resolver

NullReceiver was first spotted in fregnited npm packages “bianira-ui” and “fluid-type‑ui.” The attackers did not modify the core functionality ofર્દ modules; instead they added a backdoor that silently crafts a zero‑value Ethereum transaction. The recipient address of this transaction is a fabricated string that encodes the actual C2 server IP address.

How the Encoding Works

The process involves several stages:

1. URL‑style obfuscation: The attacker converts the IP address into a string format that resembles a valid Ethereum address (42 characters, starting with 0x).
2. Transaction creation: The npm module initiates a dummy transfer of 0 ETH to the forged address, ensuring the transaction appears legitimate on the blockchain.
3. Dead‑drop resolution: Once the compromised host runs the trojanized code, it queries the transaction history, extracts the fabricated address, and decodes it back into the IP address of the attacker’s C2 server.

Because the transaction value is zero and the recipient address is syntactically valid, most blockchain explorers flag it as normal traffic. However, the embedded data is only discoverable by hosts that run the malicious module.

Detection Challenges and Indicators

Traditional security controls often miss NullReceiver for several reasons:

• Zero‑value transactions are benign: Most monitoring tools ignore 0 ETH transfers.
• Valid Ethereum addresses: The fabricated address passes basic validation checks.
• Supply‑chain stealth: The malicious code is bundled into legitimate npm packages, making it difficult to spot without deep source‑code analysis.

Key indicators for security teams:

• Unexpected execution of npm modules that perform blockchain operations.
• Network traffic to Ethereum nodes from otherwise benign processes.
• Presence of 0 ETH transactions associated with new, recently installed packages.

Defensive Measures and Mitigation Strategies

Securing your environment against NullReceiver requires a layered approach:

• Supply‑chain integrity checks: Use tools like npm audit, Snyk, or Grivyonx’s code‑scan to validate package provenance and detect tampering.
• Runtime monitoring: Deploy application‑performance monitoring that flags unexpected blockchain interactions.
• Network segmentation: Restrict outbound connections from critical services to external Ethereum nodes.
• Behavioral analysis: Leverage AI‑driven anomaly detection to spot zero‑value transactions originating from internal hosts.
• Patch management: Keep all dependencies up to date and remove unused npm packages.

Conclusion

The emergence of NullReceiver demonstrates that even well‑known open‑source ecosystems can be weaponized in novel ways. By embedding C2 server IPs in fake Ethereum transactions, threat actors bypass traditional detection and leverage the decentralized nature of blockchains for persistence. Defensive strategies that combine rigorous supply‑chain verification, runtime monitoring, and AI‑driven anomaly detection are essential to mitigate this risk. At Grivyonx Cloud, we provide AI‑powered automation and comprehensive cybersecurity services that help organizations stay ahead of evolving threats like NullReceiver, ensuring that your infrastructure remains resilient in the face of ever‑changing attack vectors.