NullReceiver ditches the burn address that made EtherHiding easy to spot

Sonatype Research Labs released findings that six npm packages pull their command server locations from an attacker’s Ethereum wallet.

Three of the six npm packages were well-known libraries that attackers quietly took over. Anyone who installed the affected versions should remove them and look for any follow-on code that may have executed.

Attackers hijacked three real libraries 

Sonatype researcher Adam Reynolds says the six packages fall into two buckets.

The publishing accounts of real libraries appear to have been compromised so a poisoned version could ship.

These are @kolbo/mcp@1.57.1, agentgui@1.0.1127, and godot-kit@1.0.1786316795. They placed the loader on the end of a file that already came with the package, thus preserving the original functionality.

The other three were custom-built packages to carry the malware. They are envpack-conf@1.0.1, postcss-initial-provider@3.0.4, and tailwindcss-motion-advanced@1.0.1.

The first package ships configuration helpers, the other ships a working PostCSS plugin, and the last package buries the loader inside a minified utility file.

… Continue reading the full article at the original source below.