loader-delivery-mechanismpackage-repository-poisoningcommand-and-control-methoddefense-evasion-method

PolinRider Loaders Found in 10 Hijacked npm Packages Use Ethereum to Locate Payloads

Malware Intelligence · 3 sources · Updated 2d ago · First seen Nov 4, 2026

Sonatype Research Labs identified concealed runtime loaders in 12 npm releases across 10 hijacked packages, tracking the campaign as sonatype-2026-010515. The loaders query transactions from a hard-coded Ethereum wallet to derive a payload-server address, retrieve XOR-encoded JavaScript, and execute it within the application or detached Node.js processes. Shared wallet details, infrastructure, and retrieval paths connect the releases to previously documented PolinRider activity, but do not establish common ownership with GhostAction. Greenflagged documented related releases published through the npm accounts clockbook-app and pubngo-stack, including an initial variant concealed behind 157 tab characters and another using different obfuscation.

Disabling npm installation scripts does not prevent execution: the injected code runs when affected modules are loaded or applications start. Although the first malicious releases used the next distribution tag, subsequent changes exposed ordinary installations through latest, including @adminide-stack/utils@0.0.16-130 and @adminide-stack/client-redux@0.0.16-18. Organizations should identify and remove affected releases, inspect application hosts and build environments for evidence of execution, and treat systems that ran the injected code as compromised. Response should include assessing potentially exposed credentials and rotating those at risk.

Hunt this familyPull IOCs and campaign context straight into your stack.

Get the IOCs

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

11 events · Oct 27, 2026 – Nov 4, 2026

Reported Nov 4, 20263d ago
OX Security identifies 17 compromised npm packages and reports malicious releases taken down
OX Security identified malicious releases across 17 legitimate npm packages linked to PolinRider, expanding the previously documented scope of 10 packages. All listed affected releases were reported as taken down; the packages collectively receive approximately 1,400 weekly downloads, not confirmed infections.
PolinRider Returns: Hijacked npm Packages Use Ethereum Blockchain to Conceal Malware Infrastructure | OX Security
Nov 4, 20264d ago
Sonatype confirms 12 malicious releases across 10 hijacked npm packages
Sonatype Research Labs confirmed 12 malicious releases across 10 hijacked npm packages, tracking the finding as sonatype-2026-010515. Its analysis identified two obfuscation variants that resolve payload servers through Ethereum transactions and execute remotely retrieved JavaScript at runtime; shared infrastructure supports a connection to PolinRider but does not establish common ownership with GhostAction.
PolinRider Loader Reappears in Hijacked npm Packages
Reported Nov 3, 20265d ago
Second npm account publishes five additional malicious versions
Between 04:51:26 and 07:28:20 UTC, a second npm account, pubngo-stack, published five additional versions in the campaign.
@adminide-stack: tab-padded eval(atob) with an Ethereum dead-drop - Greenflagged
Nov 3, 20265d ago
Malicious @adminide-stack/user-activity-browser release becomes latest
At 23:34:37 UTC, clockbook-app published @adminide-stack/user-activity-browser@1.1.3-alpha.114 under the latest dist-tag. The release contained the same first-stage loader as the earlier Base64-obfuscated releases.
@adminide-stack: tab-padded eval(atob) with an Ethereum dead-drop - Greenflagged
Nov 3, 20265d ago
Malicious @adminide-stack/health-api-server release becomes latest
At 23:20:57 UTC, clockbook-app published @adminide-stack/health-api-server@0.0.18-alpha.465 under the latest dist-tag. Its concealed code decoded to the same first-stage loader as the initial three malicious releases.
@adminide-stack: tab-padded eval(atob) with an Ethereum dead-drop - Greenflagged
Nov 3, 20265d ago
clockbook-app publishes malicious server-hemera-mongo@0.0.16 as latest
At 23:16:58 UTC, clockbook-app published server-hemera-mongo@0.0.16 under the latest dist-tag with the same first-stage loader as the initial three releases. The malicious injection resides in dist/main.js, the application bundle invoked by the service start script.
@adminide-stack: tab-padded eval(atob) with an Ethereum dead-drop - Greenflagged
Nov 3, 20265d ago
@adminide-stack/client-redux latest moves to a malicious release
At 23:05:19 UTC, the latest dist-tag for @adminide-stack/client-redux moved to malicious version 0.0.16-18. A plain npm install of the package consequently resolved to the compromised release.
@adminide-stack: tab-padded eval(atob) with an Ethereum dead-drop - Greenflagged
Nov 3, 20265d ago
New @adminide-stack/utils release introduces a second loader variant
At 22:48:15 UTC, clockbook-app published @adminide-stack/utils@0.0.16-130 using a different obfuscation technique but the same Ethereum wallet and payload paths. Both latest and next moved to the malicious release, making it the default version for an unpinned npm installation.
@adminide-stack: tab-padded eval(atob) with an Ethereum dead-drop - Greenflagged
Nov 3, 20265d ago
clockbook-app publishes three npm releases with concealed runtime loaders
Between 22:00:33 and 22:12:11 UTC, npm account clockbook-app published three package versions containing tab-padded eval(atob(...)) injections that decoded to an identical loader. All three initially used the next dist-tag while latest remained on clean releases; the loader executed when the affected package was required, rather than during installation.
@adminide-stack: tab-padded eval(atob) with an Ethereum dead-drop - Greenflagged
Nov 3, 20265d ago
Shared Ethereum wallet advertises 95.135.181.151 as a C2 address
Greenflagged observed transactions from the shared Ethereum wallet advertising 95.135.181.151 as a command-and-control address. GitGuardian had previously identified that address on port 443 as a fallback endpoint in a PolinRider persistence script.
PolinRider Loader Reappears in Hijacked npm Packages
Oct 27, 202612d ago
GitGuardian documents PolinRider loaders in compromised GitHub repositories
GitGuardian reported PolinRider loaders using Ethereum wallet 0x1eef0849eda15d87f64e51c73c8442cf3c8bcef3 to discover payload infrastructure. The documented activity used the payload paths /0x/cls and /0x/ls on port 443, indicators subsequently found in malicious npm releases.
PolinRider Loader Reappears in Hijacked npm Packages

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Threat actors

1 linked

PolinRider

Malware

1 linked

PolinRider

Observables

5 linked

Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.

Hunt This Malware

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

Ox Security BlogNews · Nov 4, 2026

PolinRider Returns: Hijacked npm Packages Use Ethereum Blockchain to Conceal Malware Infrastructure | OX SecurityOpen source ↗

Sonatype BlogNews · Nov 4, 2026

PolinRider Loader Reappears in Hijacked npm PackagesOpen source ↗

UnclassifiedNews · Nov 3, 2026

@adminide-stack: tab-padded eval(atob) with an Ethereum dead-drop - GreenflaggedOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News