The DPRK-linked Contagious Interview campaign used NullReceiver in malicious npm packages masquerading as Tailwind CSS plugins. The code recovered C2 IPv4 addresses from the recipient field of zero-value Ethereum transactions sent by a hardcoded wallet, avoiding the smart contract and function-selector signals used by EtherRAT. The tracked wallet rotated through seven C2 addresses before transferring its balance to another wallet in October 2026. Defenders can hunt for the wallet, the `helloipbot!!` recipient suffix, and Node.js processes that query Ethereum RPC services before connecting directly to an external IP.