Malicious npm Packages Hide Attacker Servers Inside Empty Ethereum Transactions
Researchers found two booby-trapped code libraries pulling instructions from fake wallet addresses on the Ethereum blockchain, a twist on the EtherHiding trick now dubbed NullReceiver.
Key points
- Two malicious npm packages, bianira-ui and fluid-type-ui, hid their control server's address inside the recipient field of empty Ethereum transactions.
- Researchers named the technique NullReceiver, an evolution of EtherHiding, which stashes attacker instructions on public blockchains.
- Npm is the world's largest registry of open-source JavaScript code, used by millions of developers who install packages without inspecting them.
- The trick makes attacker infrastructure very hard to take down, because a blockchain record can't be deleted or blocked by a hosting provider.
- Developers who installed either package should remove it, rotate any secrets on affected machines, and audit outbound network traffic.
Security researchers have spotted a fresh trick that hides criminal infrastructure inside the Ethereum blockchain, the public ledger best known for cryptocurrency payments.
Two poisoned packages on npm, the giant online library where JavaScript developers grab ready-made code, carried the payload: bianira-ui and fluid-type-ui. Both looked like harmless user-interface helpers. They weren't.
Researchers named the technique NullReceiver. It's a twist on an older method called EtherHiding, where criminals stash instructions inside blockchain data so ordinary web filters can't easily delete them. We've tracked EtherHiding across five stories since 20 July 2026, including the ViteVenom campaign that hid its command server across four separate cryptocurrency networks.
What is actually happening here?
The malicious packages secretly look up the address of their command server, the machine that tells an infected computer what to do next, by reading a specific Ethereum transaction.
A normal Ethereum transaction moves cryptocurrency from sender to recipient. These transactions move nothing. The recipient field, which ordinarily holds a wallet address, is stuffed with encoded numbers the malware decodes into an IP address. Once decoded, the malware phones home and waits for orders.
The technique was first reported by The Hacker News, and it fits a wider pattern of criminals treating public blockchains as an untouchable message board.
Why does hiding a server address on a blockchain matter?
Because the blockchain can't be taken down. When investigators find a criminal server on a normal web provider, they can ask that provider to pull the plug. A record written to Ethereum is copied across thousands of computers worldwide and stays there permanently.
Defenders therefore have to spot and block the malicious behaviour on the victim machine, rather than cutting off the source. The criminals can also update their server address by publishing a new empty transaction: cheap and durable.
Who is at risk?
Any developer who installed one of the two packages, and any application built or shipped after doing so. Npm downloads happen automatically when a project is built, so a single careless install can spread poisoned code across a whole team's laptops and into production servers.
End users of consumer apps aren't the direct target here, but they can end up affected if a company they trust shipped software that pulled in a bad dependency. This is the third npm supply-chain attack we've reported in two months, following booby-trapped AsyncAPI packages on 15 July and 18 fake Alibaba tools on 3 August.
| Detail | Value |
|---|---|
| Malicious packages | bianira-ui, fluid-type-ui |
| Registry | npm |
| Technique name | NullReceiver |
| Related to | EtherHiding |
| Hiding place | Recipient address field of empty Ethereum transfers |
What should developers and security teams do now?
Remove both packages from any project, lockfile, or build cache. Rotate credentials and API keys that lived on machines where the packages ran, because you have to assume they were read.
Check outbound network logs for connections to unfamiliar IP addresses that appeared around the time of installation. Treat calls to public Ethereum RPC endpoints from build servers as suspicious unless your product has a clear reason to talk to a blockchain. A build pipeline chatting with a cryptocurrency network when your product has nothing to do with crypto is a red flag.
On the identity side, this isn't a login attack, so multi-factor authentication wouldn't have blocked the initial install. It would, however, limit the damage if stolen developer tokens were later used to push code or reach cloud accounts.
