Npm Packages Exploit Ethereum Blockchain for Malicious Payloads
Recent findings by Sonatype Research Labs have unveiled a concerning development in the realm of software security. A total of six npm (Node Package Manager) packages have been discovered engaging in suspicious activity, specifically querying an attacker-controlled Ethereum wallet to retrieve the next stages of malware. This nefarious operation involves extracting command-and-control (C2) addresses from blockchain transactions, revealing the increasing sophistication of cyber threats in the digital landscape.
On August 10, Sonatype Research Labs released an analysis detailing these packages, which are now being tracked under the identifiers sonatype-2026-005899 and sonatype-2026-005901. Each of the affected packages was found to carry the same malicious payload, raising concerns across the developer community regarding the integrity of npm packages.
Upon further investigation, it was revealed that the wallet address employed by the attackers was previously documented by researchers at OpenSourceMalware. They identified a technique referred to as "NullReceiver," linking this activity to the DPRK (Democratic People’s Republic of Korea)-connected "Contagious Interview" campaign, which has been associated with the notorious Lazarus group. This connection underlines the global nature of the threat, emphasizing that state-sponsored actors are employing advanced methods to execute cyberattacks on a wide scale.
Sonatype elaborated on their findings, confirming the correlation between the wallet address and the techniques utilized in this campaign. They noted similar practices such as package hijacking and the blockchain-based retrieval of follow-on infrastructure, indicating a troubling trend that exploits both popular programming tools and decentralized finance mechanisms.
A Transaction as a Dead Drop
The operation of these malicious packages is both ingenious and alarming. Upon execution, the loader queries Ethereum for outbound transactions associated with the attacker-controlled wallet. It retrieves bytes from the recipient address of these transactions, which decode into two distinct IPv4 addresses designated as primary and secondary C2 endpoints. This method of using a blockchain transaction as a data “dead drop” significantly complicates detection efforts, as it obscures the origin and intent of the communication.
Compared to earlier documented instances of similar behavior, Sonatype observed that the implementation of this loader is markedly more sophisticated. The loader does not rely on a single point of failure; it can query multiple Ethereum remote procedure call providers and even race requests between them. Should a request fail, it can batch its calls or default to the Blockscout API for locating pertinent transactions. This redundancy ensures multiple pathways for the attacker to salvage their infrastructure in the event of detection or interruption.
Once the loader successfully resolves the addresses, it retrieves two additional stages from the server. In case of a standard request failure, a retry mechanism is in place, allowing the system to recover the payload from a response header, thus increasing the resilience of the malicious operation. The resultant payload can either execute directly within the current Node.js process or initiate a separate child process, further complicating discovery.
Two Routes Into the Registry
An analysis of the six malicious packages reveals a split between hijacked and purpose-built packages, underscoring the tactical versatility of the attackers. Three of these packages—@kolbo/mcp, agentgui, and godot-kit—were found to be legitimate at first, with their respective publishing accounts having been compromised. In a deceptive tactic, the original functionality of these packages remained intact, with malicious loaders discreetly appended at the end of their files. This behavior mirrors patterns seen in the DPRK-linked PolinRider campaign, highlighting a consistency in tactics among these actors.
The remaining trio—envpack-conf, postcss-initial-provider, and tailwindcss-motion-advanced—were published with the malware embedded from the outset, each masquerading behind seemingly legitimate functionality. One disguised itself with package-configuration code, another served as a functional PostCSS plugin, and the last hid the loader within a minified utility file. This strategy demonstrates a meticulous approach to social engineering, aiming to exploit the trust developers place in established package names.
According to Sonatype, the hijacked packages pose a significant detection challenge. Given that these malicious codes infiltrate trusted and recognizable names, developers may unknowingly incorporate compromised packages into their applications. Sonatype has advised development teams to promptly check their environments for affected versions, remove them, and thoroughly investigate for any signs of unauthorized JavaScript execution or other indicators of compromise.
As the cybersecurity landscape continues to evolve, Sonatype remains vigilant, ongoing in its examination of related npm activities. The revelations serve as a harsh reminder of the persistent and evolving threats posed by advanced persistent threats (APTs) in the cyber realm, urging developers to exercise caution and diligence in their software supply chain security practices.