NullReceiver lets two North Korea-linked npm packages decode a C2 IP from blank Ethereum transfers without smart contracts or transaction calldata.
A credential-stealing worm hidden in more than 400 compromised npm packages automatically spread across software ecosystems ...