PolinRider hid loaders in 10 npm packages and used Ethereum to find its servers

Sonatype Research Labs says it confirmed concealed JavaScript loaders in 12 releases across 10 hijacked npm packages, tracked as sonatype-2026-010515. The firm’s public write-up is dated November 4, 2026; the finding continued to circulate in daily threat briefings through November 9.

What the packages do

Unlike many supply-chain worms, these releases declare no consumer install or postinstall hooks. The malicious code runs when an affected entrypoint is loaded, or, for server-hemera-mongo, when the bundled application starts. Disabling npm install scripts does not stop that path.

All 12 releases query public Ethereum RPC endpoints (with a Blockscout fallback) for transactions from wallet 0x1eef0849eda15d87f64e51c73c8442cf3c8bcef3. They treat the first eight bytes of the recipient address as two IPv4 addresses, then fetch XOR-encoded JavaScript over plain HTTP on TCP port 443 from paths /0x/cls and /0x/ls. After decoding, they run that code with eval or a detached node process. Operators can point victims at a new server by sending another transaction, without publishing a new package version.

Six releases wrap the loader in eval(atob(...)). Six others rebuild it through character permutation and the Function constructor, which avoids some obvious Base64/eval signatures while keeping the same wallet, paths and XOR keys.

Affected packages Sonatype named

Sonatype ties the wallet and retrieval paths to PolinRider loaders previously seen in compromised GitHub repositories during the GhostAction escalation. Greenflagged decoded transactions advertising 95.135.181.151 as a C2 address; GitGuardian had already listed that IP in PolinRider material. The overlap does not prove the same operator as GhostAction.

What you can do

1. Search lockfiles, caches, internal mirrors and build logs for the versions above.
2. Remove affected versions and block them from mirrors. Keep copies only if you need them for forensics.
3. Decide whether the injected code actually ran. A lockfile hit is not proof of execution; check process trees for detached node -i children and plain HTTP to port 443 on /0x/cls or /0x/ls. Payload requests may carry a Sec-V header such as A10-npm_inject.
4. If it ran, treat the host as compromised, rotate publishing credentials, cloud keys and CI secrets, and block 95.135.181.151.
5. Read our GhostAction live story for the overlapping October campaign context.

How Frame helps

Frame watches for new breach disclosures against your verified emails and gives you a short checklist when something hits. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame does not audit npm lockfiles for PolinRider; use Sonatype’s package list and your own dependency tooling.

Related coverage

• Hijacked developer accounts are planting credential stealers on GitHub and npm.
• Stolen CI access published a malicious bee-js release and a trojanized Swarm Desktop build: another November npm/desktop supply-chain case.

Sources

• Sonatype, PolinRider Loader Reappears in Hijacked npm Packages, November 4, 2026
• Cyware, Daily Threat Intelligence - November 09, 2026, November 9, 2026