Six npm packages were identified delivering a malicious Node.js loader that uses Ethereum blockchain transactions to resolve C2 infrastructure. Three packages were hijacked legitimate projects with malicious code appended to existing files, and three were newly published packages. The loader queries Ethereum RPC providers, decodes IPv4 addresses from transaction recipient addresses, and retrieves secondary payloads from HTTP endpoints. The activity is attributed to the DPRK-linked Contagious Interview campaign.
Ethereum C2
2 posts
Six npm Packages Use Ethereum Transactions to Retrieve Malicious Payloads Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages Elastic Security Labs identified a new Shai-Hulud campaign deploying a self-propagating worm called CHAINDROP that has compromised over 400 npm packages by targeting the maintainer of the widely-used keyv library. The worm abuses npm preinstall hooks to execute a cross-platform dropper (setup.mjs) that downloads the bun runtime and executes an obfuscated credential harvester targeting AI tooling, cloud providers, and developer credentials. C2 resolution uses an Ethereum smart contract for infrastructure agility, with fallbacks via GitHub commit history and victim GitHub repositories. Stolen npm tokens with write access and 2FA bypass trigger worm propagation to all packages the victim can publish.
