Hackers Hijack 10 npm Packages to Spread PolinRider Malware Using Ethereum Blockchain
PolinRider loaders use a fixed Ethereum wallet to dynamically fetch payloads via dead drop, bypassing install hooks.
70
Malware
PolinRider
- Mentions · 7d2
- Mentions · 30d4
- All mentions7
- First seenSep 21, 2026
- Last mentioned2d ago
Timeline
7 articles · newest firstPolinRider malware returns in 10 hijacked npm packages using Ethereum to deliver code
Concealed JavaScript loaders in 12 releases across 10 npm packages link to PolinRider and execute code during application startup without install hooks.
55
Gheist uses stolen GitHub tokens to leak private repository secrets
Wiz found over 13,500 planted branches from more than 850 accounts; GitHub held public runs but not private ones.
76
Gheist abuses stolen GitHub tokens to dump repository secrets
Wiz found more than 13,500 planted branches on over 850 accounts; public runs are held, but private and enterprise repos still execute.
76
ChainDrop and PolinRider Use Blockchain C2 to Steal Cloud and CI/CD Credentials
ChainDrop and North Korea-linked PolinRider use blockchain C2 to steal cloud and CI/CD credentials.
78
Evolution of Web3 in Cloud Supply Chain Attacks
Unit 42 says DPRK-linked actors use Web3 smart contracts as C2 for npm worms stealing cloud credentials.
78
Attackers Abuse npm Trusted Publishing in GHAPPIER Campaign
Attackers abused npm trusted publishing to ship the GHAPPIER loader via a legitimate package in the North Korea-linked PolinRider campaign.
72
Appears with
- GitHub Actionsproduct · 4
- GitHubvendor · 3
- npmproduct · 3
- Palo Alto Networksorganization · 2
- PolinRiderthreat actor · 2
- GitHub Enterprise Serverproduct · 2
- Megalodonmalware · 2
- GitGuardianorganization · 2
- Shai-Huludmalware · 2
- Unit 42organization · 2
- ChainDropmalware · 2
- cdeopsproduct · 1
- Sapphire Sleetthreat actor · 1
- North Koreaorganization · 1
- server-hemera-mongoproduct · 1
- @adminide-stack/forms-coreproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.