- Engineer — Act: Two named malicious packages — ‘bianira-ui’ and ‘fluid-type-ui’ — are trojanized with active C2 capability; audit all dependency trees and lock files for these packages and remove them immediately if found.
- SOC/IR — Plan: NullReceiver is a novel dead-drop resolver technique that hides C2 IPs inside empty Ethereum transfer destinations, making traditional blocklist-based detections ineffective; build or tune detections for unusual outbound Ethereum RPC calls originating from build pipelines or developer endpoints this quarter.
- Leader — Learn: Attackers are using blockchain infrastructure to evade C2 detection in software supply-chain attacks — a technique evolution worth including in risk-posture discussions, but no immediate leadership action is required given the limited scope and absence of a major corroborated campaign.