Skip to content
NewA calmer, faster ZeroHour
StoryMalwarehighExploited in the wild

PolinRider Malware Returns in Hijacked npm Packages via Ethereum Dead Drops

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

PolinRider loaders in 10 hijacked npm packages use Ethereum wallet for dead-drop payload delivery without install hooks.

Attackers hijacked 10 npm packages and inserted hidden JavaScript loaders into 12 releases. These contain PolinRider malware that uses a fixed Ethereum wallet to fetch payloads via dead drop over HTTP. The code executes on entrypoint load or during application startup with no install hooks present. Sonatype tracks the activity as sonatype-2026-010515.

Key facts
  • 10 npm packages hijacked with 12 releases containing PolinRider loaders
  • Ethereum wallet 0x1eef0849eda15d87f64e51c73c8442cf3c8bcef3 used for discovery
  • No install hooks; code executes on entrypoint load or startup
  • Fetches JavaScript from /0x/cls and /0x/ls paths
  • Affected packages include @adminide-stack/* and cdeops
  • Sonatype tracks as sonatype-2026-010515
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Nov 4, 2026Sonatype confirms PolinRider activity in hijacked npm packages · Cyber Security News

What each outlet adds

beyond the shared facts
  • GBHackersConcealed loaders execute code on entrypoint load or startup
  • Cyber Security NewsFetches payloads from /0x/cls and /0x/ls paths; affected packages include @adminide-stack/* and cdeops
Vendors
Sonatype
Products
@adminide-stack/client-redux@adminide-stack/health-api-server@adminide-stack/user-activity-browser@adminide-stack/utilsserver-hemera-mongocdeops@adminide-stack/forms-core@adminide-stack/yantra-help-browser@cdmbase/wiki-browser@pubngo-stack/help-browsernpm packages
Threat actors
PolinRider
Malware
PolinRider
Organizations
Sonatype Research LabsGitGuardian

Coverage

oldest first · one row per article · UTC
  1. · 9h ago GBHackersFirst report

    PolinRider malware returns in 10 hijacked npm packages using Ethereum to deliver code

    Concealed JavaScript loaders in 12 releases across 10 npm packages link to PolinRider and execute code during application startup without install hooks.

  2. · 3h ago Cyber Security News

    Hackers Hijack 10 npm Packages to Spread PolinRider Malware Using Ethereum Blockchain

    PolinRider loaders use a fixed Ethereum wallet to dynamically fetch payloads via dead drop, bypassing install hooks.