PolinRider Malware Returns in 10 Hijacked npm Packages Using Ethereum Blockchain to Deliver Malicious Code

A concealed JavaScript loaders in 12 releases across 10 hijacked npm packages, linking the compromise to previously documented PolinRider activity.

Investigated on November 4, 2026, the releases use Ethereum transactions to discover remote payload servers and execute downloaded code inside developer environments, build systems, or applications. Sonatype tracks the finding as sonatype-2026-010515.guide.

Unlike installation-triggered supply-chain attacks, these packages contain no consumer install or postinstall hooks.

Their malicious code can execute when an affected entrypoint loads; server-hemera-mongo activates its injection during application startup. Disabling npm installation scripts therefore does not neutralize this threat.

The loaders query public Ethereum RPC endpoints, falling back to Blockscout, for transactions sent by wallet 0x1eef0849eda15d87f64e51c73c8442cf3c8bcef3.

They interpret the recipient address’s first four bytes as a primary IPv4 address and the next four as a secondary address. Ethereum supplies the server pointer, rather than hosting the executable payload itself.

The malware requests /0x/cls and /0x/ls using plain HTTP over TCP port 443. After XOR-decoding the retrieved JavaScript, it executes the /0x/cls stage through eval inside the application and through a detached node -i process.

The /0x/ls stage runs only in a detached child process, receiving code through piped standard input.

This dead-drop mechanism lets operators redirect infected systems by publishing another transaction without updating the compromised packages.

Blocking one advertised server cannot prevent subsequent discovery of replacement infrastructure.

PolinRider Malware Attack

Six affected releases conceal their loaders inside eval(atob(...)). Six others reconstruct embedded code through character permutation and invoke JavaScript’s Function constructor indirectly.

The second variant avoids obvious Base64 and eval signatures while preserving the same wallet, retrieval paths, and XOR keys.

Entrypoint selection matters. For cdeops, the CommonJS client path reaches injected client.js, while its ES module import maps to separate client.mjs.

Exposure assessment must establish which file actually executed, rather than treating dependency presence as proof of compromise.

Sonatype Research Labs documented, the identical Ethereum wallet and matching stage paths in PolinRider loaders found in compromised GitHub repositories.

Greenflagged decoded 95.135.181.151 from wallet transactions on November 3; GitGuardian had already identified that address as fallback infrastructure.

These overlaps support the PolinRider connection but do not establish shared operators with GhostAction.

Greenflagged subsequently retrieved stages that install a Node remote-access trojan and persistence through npm’s lib/cli.js and desktop application startup files.

Its analysis identified targets including VS Code, Cursor, Discord, and GitHub Desktop, making dependency removal alone insufficient after execution.

Teams should inspect direct and transitive dependencies, lockfiles, mirrors, caches, and build records for all 12 releases.

Correlate affected entrypoints with process telemetry and outbound traffic, particularly detached Node processes and unexpected HTTP on port 443.

If injected code executed, isolate the host, preserve evidence, investigate persistence, and rotate accessible credentials. npm removal does not reverse an established host compromise.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.