Malicious npm package C2 polling via Sepolia Ethereum RPC endpoints

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•3

Detects network activity associated with the NPM Btree malware campaign, specifically TLS/HTTP communication with Ethereum Sepolia RPC endpoints (Alchemy and Infura) and requests containing a hardcoded malicious contract address.