Hackers Hijack 10 npm Packages to Spread PolinRider Malware Using Ethereum Blockchain
PolinRider loaders use a fixed Ethereum wallet to dynamically fetch payloads via dead drop, bypassing install hooks.
Attackers hijacked 10 npm packages and inserted hidden code into 12 releases. The malware uses an Ethereum blockchain wallet to locate servers and download additional payloads over HTTP. Sonatype Research Labs confirmed the activity on November 4, 2026, and tracked it as sonatype-2026-010515.
Unconfirmed: Attribution linking to PolinRider and GhostAction is disputed by Sonatype
- 12 releases across 10 packages contain the loader
- Uses Ethereum wallet 0x1eef0849eda15d87f64e51c73c8442cf3c8bcef3
- Fetches JavaScript from /0x/cls and /0x/ls paths
- Affected packages include @adminide-stack/* and cdeops
- No install hooks present, so protection is limited
Impact: deployment of PolinRider malware on developer machines
| Product | Affected |
|---|---|
| npm @adminide-stack/client-redux | various |
| npm @adminide-stack/health-api-server | various |
| npm @adminide-stack/user-activity-browser | various |
| npm @adminide-stack/utils | 0.0.16-129, 0.0.16-130 |
| npm server-hemera-mongo | various |
| npm cdeops | 13.5.31 |
| npm @adminide-stack/forms-core | various |
| npm @adminide-stack/yantra-help-browser | various |
| npm @cdmbase/wiki-browser | various |
| npm @pubngo-stack/help-browser | various |
- 1.Search lockfiles, caches and build records for bad releases
- 2.Check for detached node -i processes and HTTP requests to port 443
- 3.Rotate npm publishing tokens and CI secrets
- Vendors
- Sonatype
- Products
- @adminide-stack/client-redux@adminide-stack/health-api-server@adminide-stack/user-activity-browser@adminide-stack/utilsserver-hemera-mongocdeops@adminide-stack/forms-core@adminide-stack/yantra-help-browser@cdmbase/wiki-browser@pubngo-stack/help-browser
- Threat actors
- PolinRider
- Malware
- PolinRider
- Organizations
- Sonatype Research LabsGitGuardian
From the original article
4 min read at cybersecuritynews.com
Attackers have taken over 10 npm packages and slipped hidden code into 12 releases. The code uses the Ethereum blockchain to find a server and download more malware. Sonatype Research Labs confirmed the finding on November 4, 2026, and tracks it as sonatype-2026-010515, with a high severity score of 8.
By Kavichselvan · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.