Press play to start listening
Threat actors associated with a North Korean campaign linked to the Lazarus group are using the Ethereum blockchain as part of software supply chain attacks targeting npm users.
Security analysts from Sonatype Research Labs have reportedly found six npm packages carrying the same malicious loader, which uses public Ethereum transactions to discover command-and-control (C2) infrastructure.
Researchers found that these packages query a specific Ethereum wallet and read the recipient address of an outbound transaction to determine where the malware should connect next. The code decodes bytes from the recipient address into two IPv4 addresses, treating the public ledger like a dead drop that tells the malware where to connect next.
Two Entry Routes into npm
According to Sonatype’s blog post shared with Hackread.com, the threat actors took two different approaches to distribute the code. First, three legitimate npm packages appear to have been hijacked to publish malicious versions, with Sonatype tracking the activity as sonatype-2026-005899:
In these hijacked versions, most of the genuine features remained intact. The malicious loader was appended to existing internal files, such as the final line of database.js inside agentgui. This tactic of preserving legitimate functionality while appending a malicious loader to an existing file matches behavior Sonatype previously observed in the DPRK-linked PolinRider campaign.
Second, the hackers published three brand-new rogue packages built to drop the harmful payloads from the start, tracked as sonatype-2026-005901:
- [email protected]
- [email protected]
- [email protected] (where the loader was hidden inside utils.min.js)
How NullReceiver Directs Malware to C2 Infrastructure
The technique closely resembles NullReceiver, a blockchain-based C2 method previously linked to the DPRK-associated Contagious Interview campaign by OpenSourceMalware. That earlier activity involved the malicious npm packages bianira-ui and fluid-type-ui.
Sonatype found that the implementation in the six newly identified packages is more extensive. The loader queries multiple Ethereum RPC providers in parallel, uses batched JSON-RPC calls, and falls back to the Blockscout API if the standard methods fail.
The loader attempts to retrieve additional stages from /0x/cls and /0x/ls, then decodes the retrieved content before execution. One stage can execute directly within the current Node.js process, while downloaded payloads can also be launched as detached Node.js child processes, allowing them to run independently.
Sonatype advises developers and security teams to check their environments for the six affected packages, remove any impacted versions, and investigate systems where they were installed for follow-on JavaScript execution or other signs of compromise.
