Trojanized npm Packages Use NullReceiver to Decode a C2 IP Address from the Blockchain

Cybersecurity researchers described a technique named NullReceiver in which trojanized npm packages decode a C2 server IP address from the recipient address of a zero-value, zero-data Ethereum transfer. The activity is linked to North Korea according to the source.