PolinRider Loader Hits 10 Hijacked npm Packages Using Ethereum Dead-Drop Resolver
Do Son 
TL;DR
Sonatype Research Labs identified a concealed PolinRider loader inside 12 releases across 10 hijacked npm packages. Instead of using installation hooks, this npm PolinRider loader runs when an application imports an affected module or starts a bundled service. Furthermore, the malware reads Ethereum blockchain transactions to locate its command server and run XOR-decoded JavaScript in detached background processes.
Delivery and Attribution
The campaign compromised 10 legitimate npm packages covering Redux state tools, health APIs, browser activity trackers, and server templates. Affected packages include six @adminide-stack modules, server-hemera-mongo, cdeops, @cdmbase/wiki-browser, and @pubngo-stack/help-browser. While total victim counts remain undisclosed, any developer workstation, build server, or production container importing these specific versions risks full compromise.
Confirmed Versus Suspected Attribution
Confirmed technical attribution connects all 12 npm releases directly to the PolinRider operation documented by GitGuardian on October 27, 2026, and analyzed by Greenflagged on November 3, 2026. Specifically, all 12 releases query the exact same Ethereum sender wallet and use the same fallback server IP address and stage paths seen in earlier GitHub repository compromises. However, while PolinRider appeared alongside the GhostAction campaign in October, suspected attribution regarding a single shared operator remains unconfirmed. As the Sonatype Research Labs report notes, “The exact wallet match, overlapping server infrastructure, and matching stage-retrieval paths support linking these malicious npm releases to previously documented PolinRider activity. This connection does not depend solely on similarities in obfuscation, and it does not definitively establish that PolinRider and GhostAction share an operator.”
Infection Chain
Unlike typical malicious packages, these 12 releases contain no install or postinstall manifest scripts. Therefore, disabling npm installation scripts does not stop the infection. Instead, the PolinRider loader executes when Node loads an injected entry file or starts the main service bundle. For instance, in cdeops version 13.5.31, the malicious code runs inside the CommonJS client file before passing control to the real module, whereas the ES module file remains clean.
Attackers hid the loader using two distinct methods across the 12 builds. Six releases wrap the loader inside Base64 strings executed via eval. Meanwhile, the other six releases use a character-permutation bootstrap that scrambles an embedded text blob and runs it through the JavaScript Function constructor.
Command-and-Control and Execution Behavior
Once triggered, the npm PolinRider loader queries public Ethereum RPC nodes, or a Blockscout API fallback, to find transactions sent by a hardcoded wallet address. It reads the first four bytes of the transaction recipient address as its primary IPv4 command server and the next four bytes as a backup server. As the researchers explained, “The Ethereum wallet acts as a dead-drop resolver: the operator can advertise a new payload-server IP address by sending another transaction without updating the malicious packages.”
Next, the loader sends plain HTTP requests over TCP port 443 to two specific paths on the resolved IP address, adding custom Sec-V headers such as A10-npm_inject, A10-II, or A10-E. After XOR-decoding the responses, the loader runs the first payload inside the current application process and pipes both payloads into detached interactive Node processes that survive even after the main application closes.
Defense and Detection Guidance
Security teams should audit package-lock.json, yarn.lock, and pnpm-lock.yaml files, along with internal npm mirrors, for the 12 compromised versions. However, because the PolinRider loader triggers at runtime, defenders must also check whether applications actually imported the affected files. Endpoint hunters should look for detached interactive Node child processes receiving piped standard input and inspect network logs for plain HTTP traffic over port 443 carrying Sec-V headers. Finally, any host that executed an affected module must be treated as compromised, and administrators should rotate all repository tokens, cloud keys, and CI secrets accessible to that environment.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
