What happened
On September 18, 2026, Bitquery published a five-chain measurement of EtherHiding and related blockchain-hosted malware infrastructure. Bitquery identified 20 previously unpublished contracts around known EtherHiding activity while measuring writes across BNB Chain, Ethereum, Polygon, Bitcoin and Tron. The research used on-chain transactions, wallet relationships, timing, gas funding and financial flows rather than executing the hosted payloads.
Bitquery says a North Korean-linked wallet posted 251 payloads, including 166 after earlier public reporting, and traced gas funding to a Tron address that received $455,776 before Tether froze it. These measurements demonstrate continuing infrastructure use and financing relationships, but they are not equivalent to a count of infected enterprises or successful data theft.
The Cyber Centre found a malicious one-line JavaScript downloader hidden in tailwind.config.js and padded with more than 1,000 whitespace characters. The payload executed in the Node.js runtime embedded in Visual Studio Code or Cursor and installed an InvisibleFerret backdoor capable of file theft and command execution. The initial method used to alter the private internal GitHub repository was not established.
The Cyber Centre did not publish the precise compromise, detection or disclosure dates for the developer-toolchain incident. Attribution posture: Bitquery describes one wallet as North Korean-linked, while the Cyber Centre names no actor for its developer-toolchain incident; the records do not establish a common operator. Security teams should therefore use the shared EtherHiding technique as a detection pivot without merging distinct campaigns or attribution claims.
Why this matters now
Traditional domain blocking assumes malicious infrastructure remains directly embedded in a loader or configuration. EtherHiding moves the next-stage pointer or payload into public blockchain data, allowing operators to update destinations while compromised sites or repositories remain unchanged. Defenders must monitor the resolver behaviour and associated wallet activity, not only the current domain.
The Cyber Centre case places the technique inside a private development workflow. A concealed modification to a configuration file executed through the Node.js environment embedded in common editors, creating a path from repository trust to endpoint execution and data theft. That makes code review, repository provenance and developer endpoint telemetry part of the same control decision.
Bitquery’s measurement adds scale and persistence evidence without requiring defenders to open payloads. Its findings support treating blockchain writes, contract relationships and gas-funding paths as threat-intelligence pivots. They do not prove that every discovered contract produced a successful enterprise compromise or that separate campaigns share an operator.
The decision for security leaders
Direct application security, endpoint and threat-intelligence teams to run one joined hunt. Repository changes, editor execution and blockchain resolution can otherwise appear as unrelated low-confidence events.
Extend software-trust controls beyond package signatures. Signed dependencies do not address malicious commits, hidden configuration changes or runtime retrieval of attacker-controlled instructions from public ledgers.
Fund historical resolution capability for blockchain-based infrastructure. A current domain block is incomplete when the contract can return a new destination; defenders need wallet, contract and transaction history to reconstruct exposure.
Evidence of closure
- Repository comparison validates sensitive configuration files against approved commits.
- Endpoint hunt finds no unexplained editor, Node.js or blockchain RPC execution.
- Observed contract addresses are resolved across historical and current destinations.
- Initial-access hypotheses have documented evidence or approved residual limitations.
The Security.io assessment
The two sources describe different investigations, but together they show why EtherHiding is an architectural detection problem rather than one campaign name. Public ledgers provide durable, observable control data that operators can update and defenders can retrospectively analyse.
The Canadian incident is especially relevant because execution occurred through ordinary developer tooling after a concealed repository modification. The absence of a published initial-access method means repository integrity, identity compromise and endpoint investigation must remain open hypotheses rather than assumed conclusions.
Bitquery identified 20 previously unpublished contracts around known EtherHiding activity while measuring writes across BNB Chain, Ethereum, Polygon, Bitcoin and Tron. The Cyber Centre found a malicious one-line JavaScript downloader hidden in tailwind.config.js and padded with more than 1,000 whitespace characters. The payload executed in the Node.js runtime embedded in Visual Studio Code or Cursor and installed an InvisibleFerret backdoor capable of file theft and command execution.
Questions for the morning meeting
- Can developer repositories detect hidden configuration-file changes and excessive whitespace?
- Do endpoints alert when editors or Node.js processes make unexpected blockchain RPC calls?
- Can threat intelligence resolve changing on-chain pointers into historical infrastructure?
- Who owns containment when a repository is altered but initial access remains unknown?