Six npm packages used an attacker-controlled Ethereum wallet to conceal command-and-control server locations, including three apparently compromised legitimate libraries and three packages built to deliver the same malware, Sonatype Research Labs said. The affected versions are @kolbo/mcp@1.57.1, agentgui@1.0.1127, godot-kit@1.0.1786316795, envpack-conf@1.0.1, postcss-initial-provider@3.0.4, and tailwindcss-motion-advanced@1.0.1. Sonatype researcher Adam Reynolds said the malicious code fell into two groups: poisoned releases of real packages that preserved original functionality by appending a loader, and custom packages that embedded the same payload. The loader queried multiple Ethereum RPC providers for the wallet’s latest outbound transaction, extracted bytes from the recipient field, translated them into primary and backup IPv4 addresses, and then fetched follow-on stages from /0x/cls and /0x/ls or from an X-Payload-B64 header before decoding and executing the response in Node.js through eval() or a detached child process. Sonatype said all six samples shared the same payload and wallet. The technique is consistent with NullReceiver, an on-chain retrieval method OpenSourceMalware previously identified in the trojanized Tailwind CSS clones bianira-ui and fluid-type-ui and linked to the DPRK-linked Contagious Interview campaign associated with the Lazarus group. Sonatype said it verified the wallet match and said NullReceiver addresses a gap in EtherHiding because it sends no data and does not reuse a destination address, leaving defenders without a single fixed address to monitor. Developers who installed the affected packages were advised to remove them and check whether a second-stage payload ran.