SonatypePublished
Six npm Packages Use Ethereum Transactions to Retrieve Malicious Payloads
By Sonatype Research Team
Excerpt
TL;DR
Sonatype Research Labs identified six npm packages delivering the same malicious payload: three hijacked legitimate packages and three additional malicious packages, tracked as sonatype-2026-005899 and sonatype-2026-005901.
The malware uses the same Ethereum wallet address identified by OpenSourceMalware in activity attributed to the DPRK-linked Contagious Interview campaign, using the "NullReceiver" technique to locate infrastructure hosting additional JavaScript payloads.
Organizations that installed the affected…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Sonatype on sonatype.com.
Mentioned in the excerpt
More from Sonatype1
- How-North-Korea-Backed-Lazarus-Group-is-Weaponizing-Open-Source-Whitepaper.pdfSonatype · Added 17 Aug 2025
On the same topics
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Trust the Tunnel, Get the Trojan: Silver Fox Delivers Atlas RAT via Weaponized VPN Installershexastrike.com · Published 25 Mar
- Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent TrafficThe Hacker News · Published 19 Oct
- Investigating Ephemeral Supply Chain TamperingMandiant (Google) · Published 15 Oct
