Reported by 1 outlet

Timeline

1. original reporting

   Six npm Packages Fetch Payloads via Ethereum Transactions — DPRK-Linked Technique

   malware.news · 64d ago · August 11th, 2026

   Sonatype Research Labs identified six npm packages delivering the same malicious payload — three hijacked legitimate packages and three new malicious ones — that use the "NullReceiver" technique to retrieve infrastructure from Ethereum transactions. The activity shares the same Ethereum wallet address flagged by OpenSourceMalware in the DPRK-linked Contagious Interview campaign, extending blockchain-based delivery into the North Korean IT-worker social-engineering playbook. Review dependency trees for the flagged packages and audit for Ethereum transaction-based payload resolution.

   ---

2. update from malware.news

   Six npm Packages Use Ethereum Transactions to Retrieve Malicious Payloads

   malware.news · 64d ago · August 10th, 2026

   The malware uses the same Ethereum wallet address identified by OpenSourceMalware in activity attributed to the DPRK-linked Contagious Interview campaign, using the "NullReceiver" technique to locate infrastructure hosting additional JavaScript payloads. Organizations that installed the affected versions should remove them and investigate the impacted environment for follow-on payload execution or compromise. On August 10, 2026, Sonatype Research Labs identified six npm packages containing the same malicious payload, including three compromised legitimate packages and three packages published with the malware already present. OpenSourceMalware dubbed the specific blockchain-based command-and-co