Malicious npm Packages Hide C2 IPs in Ethereum Addresses

Researchers found trojanized npm packages that conceal command-and-control server IPs within Ethereum recipient addresses to bypass detection. The packages target software developers, posing a supply-chain risk. Developers are advised to audit dependencies and registry sources.

Sources (2)