NullReceiver Attack: How Malicious npm Packages Hide C2 Traffic on the Ethereum Blockchain

Deployed through trojanized npm packages, the method decodes attacker-controlled IP addresses from the recipient fields of zero-value Ethereum transfers — bypassing smart contract interactions and on-chain transaction data entirely.

The mechanic is stark. A compromised package receives an IP address encoded into the 42-character hex string of an Ethereum address. A zero-value transfer to that address publishes the encoded IP on-chain without invoking a smart contract. No contract bytecode. No calldata payload. The receiver in the package simply scans recent blocks for transfers where value == 0 and decodes the to field. Defenders hunting C2 traffic through contract events or transaction data find nothing.

The supply chain surface

The npm registry remains the entry point. A single maintainer compromise, a typosquatted package, or a malicious postinstall script is sufficient. Once executed, the package issues a lightweight JSON-RPC call to a public Ethereum node, walks recent blocks, and resolves the encoded address back to an IP. Traditional C2 resumes from that point.

The detection surface collapses. No DNS query for a flagged domain. No outbound connection to a known malicious range. The blockchain read itself looks like a benign RPC call. Security teams monitoring egress see only a connection to a legitimate Ethereum endpoint — Infura, Alchemy, or a public node. The covert channel is the public ledger itself.

SetProtocol: a parallel failure

The same period produced a separate failure mode on-chain. SetProtocol absorbed a loss of approximately $9.6K through a vulnerability in Index Coop's ExchangeIssuance function, per Coinfomania. The reported root cause: a malicious manager inflated positionMultiplier via a faulty pre-issue hook, enabling asset drain.

The pattern is familiar. An untrusted external call mutates protocol state before the issuance invariant is verified. The hook returns. The state is now inconsistent. The system mints against the inflated multiplier. The invariant — that issued value tracks collateral at a fixed ratio — collapses within a single transaction. A routine operation becomes an extraction primitive.

The operational floor

Two audit requirements surface from this cluster.

For npm dependencies: pin versions, verify package integrity hashes, and audit any package that performs outbound RPC reads against public blockchain nodes. A call to eth_getBlockByNumber is not benign if the response is parsed for covert channel data. Treat any package with network access to an Ethereum endpoint as a potential exfiltration vector. Strip network calls from build scripts before publishing.

For DeFi integrations: any external hook, callback, or pre-action capable of mutating state must be isolated or wrapped in a reentrancy guard before the primary state transition executes. The position multiplier is a critical invariant. It must not be settable from a hook whose return path precedes the invariant check. Read-only views are insufficient. The pre-issue hook must either revert on anomalous state or execute after the invariant is locked.

These are not recommendations. They are baseline controls for any production-grade system touching the EVM.