Trojanized npm Packages Decode C2 IP From Ethereum Recipient Addresses
NullReceiver lets two North Korea-linked npm packages decode a C2 IP from blank Ethereum transfers without smart contracts or transaction calldata.
More info