Affected Systems

Two npm packages: "bianira-ui" (109 downloads) and "fluid-type-ui" (587 downloads), published July 28, 2026 by users "npmuser1101" and "npmuser3002". Packages now removed from npm. Organizations using these packages in Node.js/JavaScript projects are affected. Attack attributed to North Korean threat actors.

Exploitation Status

Active exploitation confirmed. Packages were live on npm from July 28, 2026 and downloaded 696 times combined before removal. Attacker wallet (0xa322e5f3d311d3080e6f0121063e9adc2490ef1a) shows 68 transactions since July 27, 2026. C2 server at 166.88.134[.]62 was actively receiving connections.

Business Impact

Supply chain compromise targeting JavaScript/Node.js development environments. The NullReceiver technique encodes C2 IP addresses within Ethereum transaction recipient addresses, making detection and blocking significantly harder than traditional methods. No fixed infrastructure to blocklist. Each transaction uses a throwaway address with no reuse, eliminating traditional IOC tracking. Organizations that installed either package have exposed development or production systems to North Korean threat actors, potentially enabling code execution, data exfiltration, or lateral movement. This technique represents an operational security improvement over previous EtherHiding methods by eliminating fixed, watchable blockchain destinations.

Urgency

🔴 Immediate

Recommended Actions

  • Audit all Node.js projects and package-lock.json files for dependencies on 'bianira-ui' or 'fluid-type-ui'; remove immediately if found and treat affected systems as compromised
  • Block outbound connections to IP address 166.88.134[.]62 at firewall and proxy level; monitor for any historical connections to this IP from development or build systems
  • Monitor Ethereum blockchain transactions from wallet address 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a for new destination addresses and decode first four bytes to identify additional C2 IPs
  • Implement npm package vetting controls: restrict installations to verified publishers, enable package signature verification, and use private registries with approval workflows for new dependencies
  • Review EDR/SIEM logs from July 27, 2026 onward for Node.js processes making unexpected outbound connections, especially to non-standard IPs or Ethereum RPC endpoints (e.g., Infura, Alchemy)