As reported by The Hacker News, researchers have identified a significant evolution in blockchain-based command-and-control obfuscation — dubbed NullReceiver — observed in two malicious npm packages: bianira-ui and fluid-type-ui. The technique encodes a C2 server IP address inside a fabricated Ethereum recipient address on an otherwise empty transaction, building directly on the earlier EtherHiding playbook. At Shield53, we view this as a meaningful escalation in attacker tradecraft that demands an equally sophisticated defensive response.

Threat Alert: At Shield53, we view this as a meaningful escalation in attacker tradecraft that demands an equally sophisticated defensive response.

Why This Is a Category-Defining Threat

The original EtherHiding technique demonstrated that public blockchains could serve as immutable, censorship-resistant dead drop resolvers — a nightmare for defenders who rely on domain takedowns and sinkholing. NullReceiver refines this by embedding the C2 address inside recipient wallet addresses of zero-value transactions, meaning there is no payload in the transaction data field that conventional scanners might flag. The blockchain itself becomes the covert channel, and because Ethereum is a globally distributed, permissionless ledger, there is no single choke point defenders can pull.

"When attackers weaponize infrastructure that was never designed for security controls, every layer of the traditional detection stack needs to be re-evaluated."

What makes this particularly dangerous is the asymmetry: defenders must monitor a global, append-only ledger for encoded adversary signals, while attackers can update their C2 endpoint simply by broadcasting a new low-cost Ethereum transaction — no domain registrar, no DNS, no hosting provider to disrupt.

Who Is at Risk

Why This Is a Category-Defining Threat
Software development teams consuming open-source npm packages without rigorous dependency vetting
CI/CD pipelines that automatically install or update packages, potentially introducing malicious code before human review occurs
Organizations in fintech, Web3, and crypto where Ethereum RPC calls to public nodes are routine and less likely to trigger anomaly alerts
Managed service providers and DevOps-heavy shops where a single compromised developer environment can pivot laterally into client infrastructure

The Broader Supply Chain Implications

This incident reinforces a pattern Shield53 has been tracking across multiple package ecosystems: attackers are no longer just hiding malicious payloads inside packages — they are designing exfiltration and persistence mechanisms that leverage legitimate third-party infrastructure as the command layer. Ethereum RPC endpoints, IPFS gateways, and similar decentralized services are inherently difficult to block without causing collateral damage to legitimate workflows, especially in organizations actively developing blockchain applications.

The use of convincing, UI-component-themed package names (bianira-ui, fluid-type-ui) also highlights the ongoing typosquatting and brand-impersonation problem in public registries. Developers under deadline pressure are precisely the target: a plausible name in a quick search is enough to get an install.

Detection Considerations

Traditional signature-based detection will struggle here because the malicious logic is not executing a hardcoded IP — it is computing one at runtime by querying a blockchain. Defenders should consider:
  • Monitoring for npm packages that make outbound calls to Ethereum JSON-RPC endpoints (e.g., eth_getTransactionByHash, eth_call) at install or runtime
  • Alerting on unusual processes initiating connections to public Ethereum node providers (Infura, Alchemy, QuickNode) from non-Web3 application contexts
  • Behavioral analysis of npm lifecycle scripts — preinstall, postinstall — that perform network requests
  • Static analysis of package code for base64 decoding routines applied to blockchain-sourced strings

Shield53 Recommendations

Immediate Actions

  • Audit your dependency trees now. Search for bianira-ui and fluid-type-ui across all projects, CI runners, and developer workstations. Remove immediately and rotate any credentials accessible from those environments.
  • Lock your package manifests. Use package-lock.json or yarn.lock files and enforce integrity checking (npm ci in pipelines, not npm install).
  • Implement a private registry or allowlist. Tools like Artifactory, Nexus, or Verdaccio let you proxy and vet public packages before they reach developer environments.
  • Enable runtime network egress controls in CI/CD. Build pipelines should not have unrestricted outbound internet access. Allowlist only what is required.

Strategic Posture

  • Invest in software composition analysis (SCA) tools with behavioral scoring, not just known-CVE matching — NullReceiver-style packages may have zero CVEs assigned.
  • Treat blockchain RPC calls from non-blockchain applications as a high-fidelity anomaly indicator worth triaging.
  • Brief your development teams on the social engineering dimension: attackers are crafting package names designed to pass a casual glance. Mandatory peer review for new dependency additions is a low-cost, high-value control.

The NullReceiver technique is not an isolated experiment — it is a signal that adversaries are systematically exploring decentralized infrastructure as a persistence and communication layer. Organizations that treat open-source consumption as a low-risk activity are increasingly exposed to a class of threat their existing tooling was not designed to catch.