North Korean Sapphire Sleet Campaign: How Blank Ethereum Transactions Now Hide NPM Malware

• typo-crypto (March 2025): Likely a test run for the larger campaign. Amazon assesses this initial compromise was used to refine tactics before the main attacks .
• debug and chalk (September 2025): Two of the most downloaded npm libraries—debug alone has billions of weekly downloads. The attackers phished the maintainer via a lookalike npm domain, then pushed a wallet-draining script into at least 18 malicious package versions . The compromise reached an estimated 10% of cloud environments within two hours of publication .
• axios (March 2026): One of the most popular HTTP client libraries in the JavaScript ecosystem, with over 70 million weekly downloads at the time . Two poisoned releases (v1.14.1 and v0.30.4) introduced a malicious dependency that deployed a remote access trojan .

The attackers combined social engineering—befriending maintainers and stealing credentials—with AI-generated code designed to evade detection . Instead of modifying package runtime behavior directly, they injected trojanized updates that deployed wallet-draining scripts and credential stealers on developers' machines during package installation .

Microsoft Threat Intelligence independently attributed the Mastra AI npm supply-chain attack of June 17, 2026—which hit over 140 packages in a 45-minute window—to the same Sapphire Sleet group, assessing their finding with high confidence .

The NullReceiver Technique: Hiding C2 Servers in Ethereum Transactions

In research reported on August 2–4, 2026, security analysts at OpenSource Malware documented a new blockchain-based command-and-control technique called NullReceiver, found inside two additional DPRK-linked trojanized npm packages: bianira-ui@1.27.0 and fluid-type-ui@2.0.8 . These packages impersonate legitimate Tailwind CSS plugins and are connected to the ongoing "Contagious Interview" campaign .

How NullReceiver works :

Instead of hardcoding a C2 server address in the malware code or hiding it inside blockchain transaction data fields (as earlier techniques like EtherHiding did), NullReceiver takes a subtler approach:

1. The malware ships with a hardcoded Ethereum wallet address (0xa322e5f3d311d3080e6f0121063e9adc2490ef1a) .
2. At runtime, it queries the Ethereum blockchain for that wallet's most recent outbound transaction.
3. It reads the destination address of the latest zero-value, zero-data Ethereum transfer.
4. The bytes of that destination address, when decoded, resolve to the IP address of the next-stage C2 server.

This technique makes the C2 lookup look like any normal blockchain activity—someone sent a transfer to another wallet. There is no suspicious data payload, no hidden domain, and no static IP in the malware code itself. As OpenSource Malware noted, NullReceiver is a deliberate evolution of EtherHiding that solves earlier method's detection problems by shifting the "secret" from transaction calldata into the recipient address itself .

International Response and Attribution

Multiple major security vendors converged on the same attribution:

• Amazon Threat Intelligence assessed with medium confidence that Sapphire Sleet was behind all four package compromises, based on shared C2 indicators, code reuse, post-install hooks, and other tactics .
• Microsoft Threat Intelligence independently assessed with high confidence that Sapphire Sleet was behind the Mastra AI attack and the axios compromise , and also documented macOS-focused campaigns by the same group using Teams-themed lures .
• Google Threat Intelligence attributed the axios attack to the same actor, which they track as UNC1069 .
• U.S. government and allied cybersecurity agencies have increasingly warned about North Korean state-sponsored cryptocurrency theft via open-source software supply-chain compromises . (North Korea stole an estimated 76% of all cryptohack value in 2026 according to TRM Labs, though that figure is not solely from these npm attacks) .

Based on available sources, no explicit public statement from the North Korean government specifically denying the Sapphire Sleet or NullReceiver allegations was found. North Korea typically denies all state-sponsored cyberattack accusations through standard diplomatic channels, but a direct denial of these specific campaigns was not surfaced in this evidence set.

What This Means for Developers and Security Teams

Dozens of malicious packages now use social engineering, AI-generated code, and blockchain C2 techniques. Traditional static analysis and domain-blocking won't catch NullReceiver because no suspicious domain or IP ever appears in the malware code itself. Security recommendations from multiple sources include :

• Maintain a software bill of materials and monitor dependencies for unexpected changes.
• Use a quarantine window (refuse to install any package version published in the last 24–72 hours) to blunt fast-poisoning attacks.
• Disable lifecycle scripts where possible and install package versions deterministically.
• Treat a suspected dependency compromise as a broader credential and environment risk—rotate secrets, isolate affected systems, and monitor for follow-on activity.