Sonatype found six npm packages on August 10 that used an attacker-controlled Ethereum wallet to recover command-and-control addresses, including three hijacked trusted names: @kolbo/mcp, agentgui, and godot-kit. The other three — envpack-conf, postcss-initial-provider, and tailwindcss-motion-advanced — shipped with the same payload already embedded.
The malware runs by querying Ethereum for a transaction from that wallet and reading the bytes in the transaction data as its next server addresses. Sonatype said it could also fall back across multiple Ethereum RPC providers and Blockscout, so the infrastructure can move without changing the package again; in the hijacked packages, the loader was simply appended to existing code, which makes a trusted name part of the trust break.
For teams that consume npm dependencies, that means the package name and the registry alone do not tell you where the code will call home. If a dependency can fetch its own C2 from blockchain data, simple domain blocking and one-time takedowns leave the same loader free to recover elsewhere.