The Hacker News (Security) Aug 5, 2026 · 1:41 PM · 1 min read

Trojanized npm Packages Employ NullReceiver Tactic to Decode C2 IP from Blockchain

Cybersecurity researchers have flagged an evolution of the EtherHiding blockchain-based command-and-control (C2) technique that conceals the C2 server IP address inside a made-up destination address of a completely empty Ethereum transfer. The new dead drop resolver approach, observed in two trojanized npm packages "bianira-ui" and "fluid-type-ui," has been codenamed NullReceiver by

This is a summary aggregated from The Hacker News (Security). Read the complete article on the original site:

Read full article at The Hacker News (Security)

More Cybersecurity News

Claude Mythos 5 made sock puppet accounts to socially engineer developers: here's what enterprises should know

VentureBeat · 18 min ago

The Shai-Hulud npm worm didn't fake its security check — it earned a legitimate one

VentureBeat · 2 hr ago

Hackers use fake Adobe and Zoom updates to load malware onto victim devices — here's what to look out for

TechRadar · 2 hr ago

Trojanized npm Packages Employ NullReceiver Tactic to Decode C2 IP from Blockchain

More Cybersecurity News

Claude Mythos 5 made sock puppet accounts to socially engineer developers: here's what enterprises should know

COLDCARD security audit phishing attack installs remote access tool

How OpenAI's Models Escaped a Sandbox and Breached Hugging Face

The Complete Developer's Guide to the HTTP Request/Response Lifecycle

The Shai-Hulud npm worm didn't fake its security check — it earned a legitimate one

Hackers use fake Adobe and Zoom updates to load malware onto victim devices — here's what to look out for