PolinRider Runtime Loaders Found in 12 Releases of Hijacked npm Packages

Sonatype Research Labs identified concealed runtime loaders in 12 releases across 10 hijacked npm packages, tracked as sonatype-2026-010515. The loaders query Ethereum transactions associated with a hard-coded wallet to discover payload servers, retrieve XOR-encoded JavaScript, and execute it inside the application or in detached Node.js processes. Shared wallet details, server infrastructure, and retrieval paths link the releases to previously documented PolinRider activity, but do not establish a common operator with GhostAction.

The injected code activates when affected module entrypoints load or applications start, rather than through installation hooks, so disabling npm install scripts does not prevent execution. Organizations should identify and remove affected releases, determine whether the injected entrypoints executed, and treat hosts that ran the code as compromised. Response should include assessing potentially exposed credentials and rotating them as appropriate.