Hackers Hijack 10 npm Packages to Spread PolinRider Malware Using Ethereum Blockchain
PolinRider loaders use a fixed Ethereum wallet to dynamically fetch payloads via dead drop, bypassing install hooks.
70
Threat actor
PolinRider
- Mentions · 7d1
- Mentions · 30d1
- All mentions3
- First seenSep 21, 2026
- Last mentioned2d ago
Timeline
3 articles · newest firstHackers Use Web3 and Blockchain C2 to Hide Supply Chain Attacks Targeting Cloud Credentials
Unit 42 says the ChainDrop npm worm uses Ethereum smart contracts as C2 to steal cloud and developer credentials.
79
Attackers Abuse npm Trusted Publishing in GHAPPIER Campaign
Attackers abused npm trusted publishing to ship the GHAPPIER loader via a legitimate package in the North Korea-linked PolinRider campaign.
72
Appears with
- npmproduct · 2
- PolinRidermalware · 2
- Ethereumproduct · 1
- server-hemera-mongoproduct · 1
- North Koreaorganization · 1
- GitHubvendor · 1
- DEV#POPPERmalware · 1
- ChainDropmalware · 1
- Sonatype Research Labsorganization · 1
- GitGuardianorganization · 1
- Sonatypevendor · 1
- GitHuborganization · 1
- CloudSEKorganization · 1
- CloudSEKvendor · 1
- cdeopsproduct · 1
- npmorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.