Six npm Packages Use Ethereum Transactions to Retrieve Malicious Payloads
Six npm packages — three hijacked from legitimate projects — now use Ethereum smart contracts as a censorship-resistant channel to fetch malicious payloads, marking a practical evolution of blockchain-based C2 in supply-chain attacks.
Summary written by editorial AI · Source link below
TL;DR Sonatype Research Labs identified six npm packages delivering the same malicious payload: three hijacked legitimate packages and three additional malicious packages, tracked as sonatype-2026-005899 and sonatype-2026-005901 . The malware uses the same Ethereum wallet addr ess identified by OpenSourceMalware in a ctivity attributed to the DPRK-linked Contagious Interview campaign, using the "NullReceiver" technique to locate infrastructure hosting additional JavaScript payloads. Organization
Editorial Analysis
Blockchain-based command-and-control channels cannot be taken down via traditional domain seizures, forcing security teams to rethink how they detect and block supply-chain payload delivery.
Scan all npm dependency trees for the six identified packages and implement real-time SCA alerting for newly hijacked packages in your registries.
Attackers are embedding malware distribution in blockchain infrastructure that cannot be seized or blocked by conventional means, raising the bar for software supply-chain defence.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at Sonatype Blog in a new tab.
More from the DevSecOps Desk
- Nearly 1.5 million exposed secrets targeted in new revocation program4d
- From Lab to Reality: A Practical Evaluation of Deep Learning Models and LLMs for Vulnerability Detection4d
- A.S.E 2.0: Understanding How Repository Context Impacts the Security of LLM-Generated Code4d
- A Hybrid Approach for Automated Security Pattern Recovery4d
- Chainguard endpoints now handle breaking changes5d