PolinRider malware returns in 10 hijacked npm packages using Ethereum to deliver code

Concealed JavaScript loaders in 12 releases across 10 npm packages link to PolinRider and execute code during application startup without install hooks.

A concealed JavaScript loader was found in 12 releases across 10 hijacked npm packages. The packages link to previously documented PolinRider activity. The releases use Ethereum transactions to discover remote payload servers and execute downloaded code inside developer environments, build systems, or applications. Sonatype tracks the finding as sonatype-2026-010515.guide. Unlike typical supply-chain attacks, these packages contain no consumer install or postinstall hooks. Their malicious code executes when an affected entrypoint loads; server-hemera-mongo activates its injection during application startup. Disabling npm installation scripts therefore does not neutralize this threat. The loaders query public Ethereum RPC endpoints for transactions sent by a specific wallet and fall back to Blockscout. They interpret the recipient address’s first four bytes as a primary IPv4 address and the next four as a secondary address. After retrieving and XOR-decoding JavaScript, it executes the primary stage through eval inside the application and through a detached node -i process. This dead-drop mechanism lets operators redirect infected systems by publishing another transaction without…