Evolution of Web3 in Cloud Supply Chain Attacks

What it is

Unit 42 describes how supply chain malware resolves command-and-control (C2) through public blockchains, so no domain or IP is hard-coded in the package. The page names three techniques: EtherHiding, TxDataHiding and NullReceiver. It ties them to the ChainDrop npm worm, the PolinRider campaign, and DPRK-linked compromises of Axios, Mastra AI and Rust's arrayref. The stated target is cloud credentials on developer machines and CI/CD runners.

How it works

• EtherHiding: the loader makes read-only eth_call JSON-RPC requests to a hard-coded smart contract and reads C2 domains from its state variables. The contract address appears in the request as "to": "0x...", so one address can be flagged and blocked.
• TxDataHiding: encrypted C2 payloads sit in the raw input data (calldata) of ordinary transactions, often sent to router contracts or burn addresses. The loader reads them with eth_getTransactionByHash or calldata parsing and decrypts in memory. PolinRider variants fall back across TRON, Aptos and BSC, so a blocked chain is replaced by a new transaction on another.
• NullReceiver: the loader queries an actor-controlled wallet for its latest zero-value transaction and takes the C2 IPv4 from the 20-byte recipient address. It reads the address, checks an ASCII validation marker, converts the leading 4 bytes to decimal, and connects out. There is no contract, no calldata and no domain string to inspect.

PolinRider combines these in a hybrid design. Zero-data transfers serve as a backup if the primary RPC gateways or multi-chain lookups are blocked.

flowchart TD
    A[Loader starts] --> B{RPC gateways and multi-chain lookups reachable?}
    B -->|yes| C[Resolve C2 via contract or calldata]
    B -->|no, blocked| D[NullReceiver: IPv4 from recipient address]
    C --> E[Connect to C2]
    D --> E

Preconditions / Affected

• ChainDrop (Shai-Hulud family) infected over 400 npm packages, including keyv and cacheable-request. A preinstall hook downloads a custom Bun runtime and runs an obfuscated harvester. It scans disk and the memory of running build processes for ephemeral cloud IAM keys, CI/CD worker tokens and short-lived OIDC federation keys. It then adds persistent task hooks that fire when a developer opens a project or starts an AI coding session.
• PolinRider spans npm, Go modules and Packagist. Loaders hide in repository config files, web resources and IDE workspace automation, so they do not depend on install scripts.
• NullReceiver was seen in the front-end packages bianira-ui and fluid-type-ui.
• DPRK actor (Alluring Pisces, also called Sapphire Sleet or Midnight Neptune):
• Axios: the lead maintainer was compromised and a backdoored dependency, plain-crypto-js, was injected. The payload ran in build pipelines to steal cloud tokens and target macOS code-signing certificates.
• Mastra AI: poisoned npm packages used build hooks to scrape environment variables and cloud keys.
• arrayref: the crate on crates.io used Rust's compilation hook to run a second-stage payload.
• Unit 42 links the three through matching C2 beacon behaviour, SSL configuration and clustered VPS ranges.

What to do

The page gives guidance, not queries or commands.

1. Decide whether blockchain traffic is ever legitimate for your organization. If not, any outbound blockchain interaction is a high-confidence anomaly and can be blocked.
2. Inspect at process level on developer workstations and CI/CD runners. Alert when runtimes, scripting engines or compilers, which are not crypto tools, query public blockchain gateways.
3. Apply automated policy on CI/CD runners and version control to flag unauthorized changes to repository config files, hidden script injections in package manifests, and unverified package lifecycle hooks before build execution.
4. Do not rely on static IoC blocklists. The page says they are insufficient for these techniques.

Caveats

• Blocking a single contract address only helps against EtherHiding. The later phases remove that indicator.
• Stolen credentials can bypass MFA "if other controls are not in place".
• The page offers no IoCs, detection rules or RPC endpoint lists. It points to other write-ups, including Unit 42's ChainDrop and Axios pieces, for that detail.