Sonatype Research Labs says six npm packages were found using an attacker-controlled Ethereum wallet to retrieve command-and-control server locations, including three legitimate libraries that appear to have been hijacked and republished with malicious code.

The firm said anyone who installed the affected versions should remove them and investigate whether any second-stage payloads were fetched and executed. The campaign relied on a blockchain-based lookup method designed to make the malware’s infrastructure harder to track and take down.

Compromised and custom packages identified

According to Sonatype, the affected packages were @kolbo/mcp@1.57.1, agentgui@1.0.1127, godot-kit@1.0.1786316795, envpack-conf@1.0.1, postcss-initial-provider@3.0.4 and tailwindcss-motion-advanced@1.0.1.

The first three were described as real, established npm libraries that attackers quietly took over. The other three were purpose-built packages created to carry the same malware loader. Sonatype’s warning focused on both groups because the underlying payload and delivery approach were shared across all six entries.

How the Ethereum-based lookup worked

The malicious loader did not hardcode its command servers directly in the package. Instead, it queried Ethereum for the last outbound transaction from a wallet controlled by the attacker, then pulled bytes from that transaction’s recipient field.

Those bytes were decoded into two IPv4 addresses, which served as the primary and backup command-and-control servers. Sonatype said the code queried several Ethereum RPC providers, bundled JSON-RPC requests in batches, and used the Blockscout API as a fallback when direct blockchain queries failed.

After locating a server, the malware requested the /0x/cls and /0x/ls endpoints, or relied on an X-Payload-B64 header when necessary. The returned content was then Base64-decoded, XOR-decoded and executed either inside the Node.js process with eval() or through a detached child process.

A variant of EtherHiding with a lower profile

The report describes the technique as a slimmer version of EtherHiding. In the samples Sonatype analyzed, the hidden value was placed in transaction data and the operator avoided repeatedly using the same destination address, a behavior that made earlier EtherHiding activity easier to identify because it consistently pointed to the burn address.

In one decoded sample, recipient bytes resolved to the IPv4 address 166.88.134.62. Sonatype also found trailing bytes spelling “helloipbot!!,” which it described as an attacker fingerprint embedded in the transaction data.

Attribution claims and immediate next steps

Sonatype linked the on-chain retrieval method to the DPRK-linked Contagious Interview campaign and the Lazarus group, though the article presents that connection as analysis rather than a confirmed legal attribution.

The immediate confirmed step from the research is defensive: organizations and developers that installed any of the listed package versions should remove them and review systems for follow-on code execution. Because the loader was designed to fetch a second-stage payload dynamically, the package contents alone may not show the full extent of what ran on an affected machine.

Source: Cryptopolitan