Provenance Record

Well-structured News piece (Overview / What We Know / What We Don't Know / Analysis) at 713 words, within the 400-1200 News range. Technical explanation of the NullReceiver blockchain C2 technique is clear and accurate. The 'What We Don't Know' section appropriately flags real gaps (no download counts for the six new packages, no confirmed link between the two package sets' operators, no disclosed compromise vector, no CVE) rather than inventing false certainty.

Both sources were fetched successfully (HTTP 200, no archive_fallback) and read in full from the gzipped snapshots on disk: sources/2026-08/six-npm-packages-compromised-to-pull-malware-command-and-control-addresses-from-ethereum-transactions/source-0.html.gz (Sonatype blog, sha256 3b99fe55... verified by re-hashing the decompressed content, matches manifest) and source-1.html.gz (The Hacker News, sha256 0733a8d5... verified, matches manifest). I decompressed both with gunzip, extracted plain text, and cross-checked every specific claim, package name/version, advisory number, wallet-technique description, and direct quote in the article body against the raw snapshot text. All package names/versions (@kolbo/[email protected], [email protected], [email protected] under sonatype-2026-005899; [email protected], [email protected], [email protected] under sonatype-2026-005901), the bianira-ui/fluid-type-ui download counts (109 and 587) and July 28, 2026 publish date, the five additional package names from the Update section (post-css-transfer, scrollbar-hide-plugin, tailwind-anim, tailwind-animation-founder, tailwindcss-anim), and the PolinRider/Contagious Interview attributions all confirmed verbatim against source text. Both source URLs appear in article.sources — no orphan links.

All specifics (package names, versions, advisory IDs, wallet-technique mechanics, campaign names, dates, download counts) trace to the two cited sources. No hallucinated facts detected.

Clean, well-sourced, accurately reported submission on a genuinely new story. Both sources verified in full from disk snapshots with matching hashes. No suspicious/injection content in either snapshot. One cosmetic quote-fidelity nit does not rise to the level of a public correction. Approved as-is.