Trojanized npm Packages Decode C2 IP From Ethereum Recipient Addresses

Cybersecurity researchers have discovered an updated version of the EtherHiding technique, which hides command-and-control server IP addresses within fake Ethereum transfer recipient addresses. This new approach, called NullReceiver, involves using empty Ethereum transfers to conceal the IP address. The technique has been observed in two compromised npm packages, bianira-ui and fluid-type-ui. These packages have been trojanized, allowing attackers to use the NullReceiver method to decode the C2 IP address from Ethereum recipient addresses. The evolution of this technique highlights the continued use of blockchain-based methods for command-and-control communication. The NullReceiver approach is a notable development in the EtherHiding technique.