Malicious code in bianira-ui (npm)
The npm package bianira-ui contained malicious code that executed on import, enabling remote code execution via a blockchain-based dead-drop C2 mechanism. The payload used unicode escapes to evade detection and dynamically resolved C2 endpoints through Ethereum transactions.
- Disclosed
- Last updated
- Blast radius
- Any system that installed and imported the bianira-ui package
- Ecosystems
- Attack vectors
- Affected entities
- bianira-uinpm package with malicious code in plugin.js
The npm package bianira-ui was found to contain malicious code in its main entry point (plugin.js). The malicious payload was an immediately-invoked function expression (IIFE) that executed whenever the package was required or imported.
The attack used sophisticated evasion techniques, encoding all network-related identifiers (HTTP/HTTPS, child_process, URLs, RPC methods, C2 hosts, and attacker addresses) as unicode escapes (\uXXXX) to bypass static code inspection tools.
The payload implemented a blockchain-based dead-drop C2 mechanism: it queried the Ethereum RPC endpoint eth.drpc.org for the latest transaction from a hardcoded attacker address (0xa322e5f3d311d3080e6f0121063e9adc2490ef1a), derived a C2 IP address from the first 4 bytes of the transaction's to field, then fetched two XOR-encrypted payloads over plain HTTP from paths /0x/cls and /0x/ls on the derived host. The first payload was passed to eval() and the second was executed via spawning a node process, yielding full remote code execution.
This design allowed the attacker to dynamically rotate C2 endpoints by publishing new Ethereum transactions, making the infrastructure difficult to take down through traditional blocking methods.
Indicators of compromise
- Packages
- bianira-ui
- Domains
- eth.drpc.org
Remediation
- Immediately uninstall bianira-ui from all systems
- Audit all systems that previously installed bianira-ui for signs of compromise or unauthorized code execution
- Review network logs for connections to the derived C2 IP addresses
- Rotate all credentials and secrets on affected systems
- Monitor for any suspicious child processes or eval() executions in application logs
- Use npm audit to identify any remaining malicious dependencies
- Consider using package integrity verification and allowlisting for npm dependencies in the future
Sources
- GitHub Advisory GHSA-w3r2-397p-xcfw · GitHub Advisory Database
Cite this entry
"Malicious code in bianira-ui (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 28, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-bianira-ui-npm-q6d6e8
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in @omniwatch-wick/cli
Malware discovered in the npm package @omniwatch-wick/cli. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - activecritical
Malware in chain-manager
Malware discovered in the npm package chain-manager. Systems with this package installed or running are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malicious code in toll_free (npm)
The npm package toll_free version 1.0.1 was identified as malicious by the OpenSSF Package Analysis project. The package executes commands associated with malicious behavior.
npmCompromised package - containedcritical
Malicious code in blots (npm)
The npm package 'blots' version 2.1.0 was identified by the OpenSSF Package Analysis project as containing malicious code that executes commands associated with malicious behavior. The package has been flagged in the OpenSSF malicious packages database.
npmCompromised package