Trojanized npm Packages Employ NullReceiver Tactic to Decode C2 IP from Blockchain

thehackernews.com Aug 6, 2026

Trojanized npm Packages Employ NullReceiver Tactic to Decode C2 IP from Blockchain

Curated by Shubham · TechCapsules · Aug 6, 2026

AI-summarised brief · reviewed before publication

Cybersecurity researchers identified a new blockchain‑based command‑and‑control method called NullReceiver, used by trojanized npm packages “bianira‑ui” and “fluid‑type‑ui.” The technique hides a C2 IP address inside the recipient field of a zero‑value Ethereum transfer, eliminating the need for a smart contract or calldata payload. Linked to North Korean actors, the method offers cheaper, harder‑to‑track communications than the earlier EtherHiding approach. The packages, now removed from npm, had been downloaded a few hundred times since their July 28, 2026 release.

💡 Why It Matters

· NullReceiver’s use of throwaway, empty transfers removes the fixed target that defenders can monitor, making attribution and disruption significantly harder.
· This evolution demonstrates how threat actors continually refine low‑cost, low‑visibility tactics to evade detection.

Read full article on thehackernews.com

T’gana leveraging latest tech to improve governance: Sridhar Babu

Telangana IT and Industries Minister D Sridhar Babu announced plans to launch a digital assembly and digital council proceedings to modernise governance. At the AI Transformation Conclave, he highlighted the state’s use of AI, blockchain, data analytics, and quantum computing to enhance public service delivery. The government will issue blockchain‑based certificates for citizen data security and expand high‑speed T‑Fiber connectivity to rural areas, aiming for doorstep services for senior citizens and persons with disabilities. Paperless administration is underway under the Digital Office Project, while a digital cabinet and real‑time dashboard already integrate 20 departments.

💡 By embedding blockchain and AI into core governance, Telangana sets a precedent for secure, data‑driven public administration, potentially reshaping how state services are accessed and delivered.

openpr.com · Aug 6

Web3 Dashboard Development: Build Fast, Secure, and User-Friendly Blockchain Applications

Web3 dashboard development focuses on creating intuitive interfaces that let users manage wallets, view token balances, track transactions, and interact with smart contracts without navigating complex blockchain data. By integrating wallet connectivity, real‑time analytics, portfolio management, and mobile‑friendly design, these dashboards streamline user experience, build trust, and boost engagement. A well‑crafted dashboard becomes the first touchpoint for users, reducing drop‑off rates and encouraging repeat use. The approach is essential for projects ranging from DeFi platforms to NFT marketplaces, where usability directly impacts adoption and retention.

💡 A polished dashboard turns a technical platform into a user‑friendly product, turning casual visitors into loyal participants.

openpr.com · Aug 6

The Future of AI and Blockchain: How Intelligent Decentralization Is Transforming Industries

The article explains how combining Artificial Intelligence with blockchain technology creates a secure, self‑optimizing system that addresses blockchain’s scalability, data storage, and security monitoring challenges. AI’s machine‑learning algorithms can analyze on‑chain data, detect fraud, and predict cyber threats in real time, while blockchain supplies tamper‑proof, high‑quality data for training models. This synergy enables faster, cheaper transactions, improved data analytics, and proactive security, positioning AI‑integrated blockchains as a transformative force across industries.

💡 By turning reactive security into predictive defense, the fusion offers a practical solution to the growing threat landscape that traditional blockchains cannot handle alone.

mpost.io · Aug 6

ChangeNOW Brings Martin Masser Into Its Crypto Super App

ChangeNOW has appointed former TON executive Martin Masser as Director of Strategic Partnerships to drive its transition into a crypto super app. Masser brings experience from traditional banking, Web2, and Web3, and will forge relationships with blockchain networks, wallets, fintech firms, and payment providers. The move follows ChangeNOW’s strategy to bundle buying, storing, swapping, trading, sending, receiving, and growing digital assets into a single platform, simplifying the fragmented user experience. His focus will be on building partnerships that enhance product functionality and market visibility.

💡 By unifying disparate crypto tools, ChangeNOW aims to reduce friction for users and businesses alike, potentially setting a new standard for integrated digital‑asset management.

thenextweb.com · Aug 5

A worm tore through npm by making the malware look perfectly legitimate

A self‑spreading worm dubbed “ChainDrop” compromised the npm registry on Tuesday, injecting malicious code into hundreds of packages that collectively account for billions of monthly downloads. The attack began with the hijacking of the GitHub account of the maintainer of the popular caching library keyv, which is fetched roughly 150 million times weekly. Using the compromised account, the attacker pushed poisoned commits to the projects’ main branches, allowing each package’s automated release pipeline to publish malicious versions that carried valid GitHub Actions provenance. The worm added pre‑install hooks that executed a dropper, which fetched the Bun runtime and stole a wide range of credentials—including npm, GitHub, AWS, Kubernetes, Vault, SSH keys, and AI‑tool tokens. It then used stolen npm tokens to republish trojanized packages, creating a self‑propagating loop. Command‑and‑control is resolved via an Ethereum smart contract, and persistence hooks are embedded in AI coding tools such as Claude Code and VS Code, enabling re‑execution simply by opening an infected repository.

💡 By exploiting trusted build provenance, the worm bypasses typical security checks and can silently hijack the supply chain of countless downstream projects, turning the open‑source ecosystem into a rapid distribution channel for credential theft.

us.headtopics.com · Aug 4

ShopinX Launches SPX Utility Token on BNB Smart Chain for Real-World Spending

ShopinX has launched SPX, a BEP‑20 utility token on the BNB Smart Chain, designed for everyday spending rather than speculation. The token features a fixed supply of one billion units and a revenue‑driven buyback‑and‑burn mechanism to create scarcity. SPX holders can convert tokens into gift cards, vouchers, and discounts at more than 400 merchants, including Amazon, IKEA, Google Play, and Apple. The smart contract passed an independent audit by SolidProof, received KYC verification, and earned a TrustNet score of 88.71, with full on‑chain transparency.

💡 By enabling direct conversion of crypto into widely used retail goods, ShopinX bridges blockchain assets with real‑world commerce, offering a tangible use case that could reshape how consumers interact with digital currencies.