Chollima Hunter

← Remote Workers

bianira-ui

bianira-ui is an npm package that one published source reports in connection with NullReceiver and Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from OpenSourceMalware. The report is dated 2026-08-02.

npm package NullReceiverContagious Interview CURATED Taken down checked 2026-10-05

OSV advisories

  • MAL-2026-11132 published 2026-07-28 Malicious code in bianira-ui (npm)

First seen 2026-08-02 · last seen 2026-08-02

Source

  • Trojanized npm clone of a Tailwind CSS plugin that OpenSourceMalware reports as carrying the NullReceiver C2 technique (reported version bianira-ui@1.27.0): it reads its command server from the recipient address of an empty Ethereum transfer sent by a hard-coded wallet. OpenSourceMalware attributes the activity to the DPRK Contagious Interview campaign. The package is no longer available from npm.
    NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding — OpenSourceMalware · published 2026-08-02 · pulled 2026-10-03

Find this indicator in the index, or see every npm package this site holds under Npm packages in the browse listing.

Related indicators

Cited by the same report: NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding

OpenSourceMalware lists 15 other indicators in this source. 12 are shown, chosen across types.

All 16 indicators from this source

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.