Hackers Hijack 10 npm Packages to Spread PolinRider Malware Using Ethereum Blockchain
PolinRider loaders use a fixed Ethereum wallet to dynamically fetch payloads via dead drop, bypassing install hooks.
Stories per day · 30 days
5 RSS
Relatedethereum2npm2supply-chain2blockchain1gheist1github1github-actions1secret-exfiltration1stolen-tokens1
7 stories, newest first · one card per story
Stories tagged #polinrider
Gheist abuses stolen GitHub tokens to dump repository secrets
Wiz found more than 13,500 planted branches on over 850 accounts; public runs are held, but private and enterprise repos still execute.
2
Hackers Use Web3 and Blockchain C2 to Hide Supply Chain Attacks Targeting Cloud Credentials
Unit 42 says the ChainDrop npm worm uses Ethereum smart contracts as C2 to steal cloud and developer credentials.
ChainDrop and PolinRider Use Blockchain C2 to Steal Cloud and CI/CD Credentials
ChainDrop and North Korea-linked PolinRider use blockchain C2 to steal cloud and CI/CD credentials.
6
GHAPPIER Supply Chain Attack Compromises 65 GitHub Repositories and Poisons npm Package
GHAPPIER supply chain campaign compromised 65 GitHub repositories and pushed a malicious four-stage npm loader via compromised maintainer trusted publishing.
Malicious npm Package indexed-btree Hid Its Loader in Runtime Code Before Removal
Checkmarx details malicious npm package indexed-btree hiding its loader in runtime code, netting €230,000; Socket flags PolinRider Packagist compromise.
3
Hackers Compromise 65 GitHub Repositories and Poison npm Package With Hidden Backdoor
CloudSEK details GHAPPIER campaign compromising 65 GitHub repos to backdoor the @dforge-core/dforge-mcp npm package with cryptographically verified provenance.