North Korean Hackers Turn Ethereum Into Malware Infrastructure in New npm Campaign

DPRK-linked threat actors are abusing Ethereum transactions as a stealthy command-and-control mechanism in a new software supply chain campaign targeting npm developers, according to research from Sonatype.

Sonatype Research Labs said it discovered six npm packages carrying the same malicious loader, including three legitimate packages that appear to have been compromised and three packages created with the malware already embedded.

The affected legitimate packages include @kolbo/mcp@1.57.1, agentgui@1.0.1127, and godot-kit@1.0.1786316795. Researchers also identified malicious versions of envpack-conf, postcss-initial-provider, and tailwindcss-motion-advanced.

What makes the campaign notable is how the malware finds its next-stage infrastructure.

Rather than hard-coding a traditional command-and-control server that defenders can block, the loader checks transactions associated with an attacker-controlled Ethereum wallet. It then extracts data from a transaction recipient address and decodes it into two IP addresses used as primary and backup command-and-control servers.

In effect, Ethereum becomes a public dead drop that tells compromised systems where to connect next.

Sonatype linked the technique to activity previously associated with the DPRK-backed Contagious Interview campaign. Researchers found the packages using the same Ethereum wallet address previously identified by OpenSourceMalware in attacks employing a technique dubbed "NullReceiver."

The method could make the attack infrastructure more resilient. Sonatype found the loader capable of querying multiple Ethereum RPC providers, racing requests between services and falling back to the Blockscout API if necessary. Once the malware identifies its command infrastructure, it can retrieve additional JavaScript payloads, decode them and execute them inside Node.js or launch them as separate processes.

The campaign also underscores a broader shift in North Korean cyber operations toward developer environments and open source software supply chains. Instead of relying exclusively on phishing or conventional malware delivery, operators are increasingly targeting the tools developers already trust.

That strategy becomes particularly dangerous when attackers compromise an established package. In those cases, developers may install what appears to be a routine update without realizing malicious code has been appended to legitimate functionality.

Sonatype advised organizations that installed the affected package versions to remove them and investigate their environments for additional JavaScript execution or evidence of follow-on compromise.

For security teams, the campaign offers another warning that blockchain infrastructure is becoming useful for more than cryptocurrency theft. Its decentralized and publicly accessible nature can also give attackers an unconventional way to hide, rotate and recover the infrastructure behind malware operations.