Researchers Trace PolinRider-Related Malware to 2025 npm Packages
Summary
Researchers traced a PolinRider-related payload in four recovered npm packages from a nine-version May 2025 burst, reconstructing a blockchain-delivered RAT and credential stealer and linking later GitHub force-push infections.
Key points
- A maintainer published nine npm package versions within 90 minutes on May 4, 2025; researchers recovered four packages and confirmed the malicious payload in each.
- The payload was obfuscated JavaScript appended after long whitespace and executed when an application imported the package; the packages had no install hooks.
- Researchers reconstructed a blockchain-delivered chain involving JADESNOW, an INVISIBLEFERRET bootstrapper, a Socket.IO RAT and a Python stealer. Shared keys, command-server details and paths support the PolinRider link.
- The stealer can target browser data, credentials, wallets, developer accounts and cloud storage across Windows, Linux and macOS; the article reports capabilities, not confirmed victim theft.
- The RAT supports remote shell commands and file transfers. Researchers found no mechanism for persistence across a reboot.
- Related payload variants appeared in GitHub repositories through force-pushes in four windows from January to July 2026. Some variants were not decoded, and the article presents the likely infection mechanism as an assessment.
- Clean package replacements followed the 2025 burst, but infected versions remained installable by pinned version; researchers recommend hunting for affected versions, padded code and unusual force-push activity.
Article Details
- Attack Vectors
- Nine versions of npm packages from one maintainer were published within 90 minutes on May 4, 2025; four recovered packages contained the same malicious payload. Importing the affected package triggered the obfuscated JavaScript in its entry point, without an install hook.
- The payload retrieved encrypted stages from BNB Smart Chain and Ethereum transaction data, then downloaded support files from a command server.
- The malware provided a Socket.IO RAT for operator commands and collected browser, wallet, developer, password-manager, and cloud-storage data for exfiltration.
- The article assesses that the 2025 package releases were probably caused by account takeover, while the 2026 GitHub infections used force-pushes from the maintainer's account; both assessments are presented as likely rather than confirmed.
- Defensive Notes
- Check lockfiles and node_modules for the affected package versions, including [email protected], [email protected], and [email protected].
- Hunt for unusually long lines preceded by whitespace in index.js or webpack.config.js, the markers global['_V'], global.i=, and global.o=, and unexpected Node.js command lines containing -e and global['_V'].
- Review GitHub force-pushes that alter only a config file, retain the commit message and author date, or have unusual committer dates or timezone offsets; compare GitHub push times rather than relying on commit dates.
- Look for Node.js querying blockchain explorers before spawning node -e, and for connections to port 3306 using HTTP or Socket.IO rather than MySQL.
- Investigate unexpected creation of tmp7A863DD6.tmp, /tmp/.npm, ~/.node_modules, or ~/.pyenv, runtime installation of dependencies, recursive browser or wallet directory collection, and Telegram sendDocument traffic from developer systems.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 154[.]91[.]0[.]103 | Command server used by the bootstrapper, including for status reporting and delivery of Python support files. |
| IPV4 | 85[.]239[.]60[.]213 | Attacker upload server used by the RAT and stealer. |
| IPV4 | 85[.]239[.]62[.]36 | Attacker server used for the Socket.IO RAT and for stealer uploads. |
| SHA256 | 489df9fa032455af30066af90404285cab7191823ef6770c691b9ef8bb84c16f | SHA-256 of the malicious webpack.config.js from itsa-react-button 16.0.11. |
| SHA256 | 4b766d33afb2552178939fff99bc2a01773d2aa69a000e27df4e8fdb185470e6 | SHA-256 of the JADESNOW stage recovered from the blockchain-delivered payload. |
| SHA256 | 4d28e46ae8181a665cdc6814ced72348720281b35275c95fd44fabadf7993aa8 | SHA-256 of the Node.js RAT stage. |
| SHA256 | 8c934e6fd9f689d60233bbec4370896778f6b286e9d00df7e94afd6dc9f44cc4 | SHA-256 of the malicious webpack.config.js from itsa-react-docviewer 16.1.2. |
| SHA256 | 8eede6e92a37119937351ca956bdba123b486aa07c090d21adc1361075167bf7 | SHA-256 of the malicious index.js from itsa-jsext 2.0.3. |
| SHA256 | 8ef2c6fc0347853469bd19203c4aa37f17192cc6faec21c8c4be0b1cdbf00104 | SHA-256 of the malicious index.js from itsa-utils 1.4.2. |
| SHA256 | 9a55dc9cc568d1b0864c76fcd7acbacba63d05459c6044b5fc0a8c35955df078 | SHA-256 of the infected itsa-jsext-2.0.3 npm package archive. |
| SHA256 | c7c221ae9920b9b2e8f248b1aba4d801d91e5da934d5af77afa63f9bfc22fe54 | SHA-256 of the unpacked Python stealer. |
| SHA256 | c9dab995cf61a066db149c8d5d4ce171fb9d20d246994a1fa4f27a5885088bbb | SHA-256 of the infected itsa-utils-1.4.2 npm package archive. |
| SHA256 | cf658925d5ec72e696432b20b8d3e384fe3eca871f087833b58a12a751ab18d1 | SHA-256 of the infected itsa-react-docviewer-16.1.2 npm package archive. |
| SHA256 | e86a5bacd23e63f19f2cf74d6d5b13d8e8759d39e2310aa4e8e8868a63dfbd91 | SHA-256 of the infected itsa-react-button-16.0.11 npm package archive. |
| SHA256 | e929abd9511ed0603c8efc44f1a0670699dbca33760585de3f8fdbd14681b1b6 | SHA-256 of the malicious variant A payload line, reported as byte-identical in four recovered packages. |
| SHA256 | efbe59e9bf34b9dae8a7d809dafd77751db5b45431417436675485d1d01bcf19 | SHA-256 of the wrapped Python stealer. |
| SHA256 | f30ddf3727e3be98962d6c9f24a93a43c42c32e28b930c80c703b38697a97248 | SHA-256 of the malicious bootstrapper stage. |
| URL | hxxp[:]//154[.]91[.]0[.]103:27017/d/7zr.exe | Archive utility delivery URL identified in the malware chain. |
| URL | hxxp[:]//154[.]91[.]0[.]103:27017/d/pyenv.zip | Python environment support-file delivery URL identified in the malware chain. |
| URL | hxxp[:]//154[.]91[.]0[.]103:27017/d/python.7z | Python support-file delivery URL identified in the malware chain. |
| URL | hxxp[:]//154[.]91[.]0[.]103:27017/d/python.zip | Python support-file delivery URL identified in the malware chain. |
| URL | hxxp[:]//154[.]91[.]0[.]103:27017/verify-human/5-itsa | Bootstrapper status-reporting endpoint on the attacker command server. |
| URL | hxxp[:]//85[.]239[.]60[.]213:27017/u/f | Attacker upload endpoint used to receive RAT uploads and stolen data. |
| URL | hxxp[:]//85[.]239[.]62[.]36:27017/u/f | Attacker upload endpoint used by the stealer to exfiltrate data. |
MITRE ATT&CK
T1005 · Data from Local SystemThe stealer collected data from local browser profiles, wallets, developer credentials, password managers, and cloud-storage directories.T1027 · Obfuscated Files or InformationThe JavaScript payload was heavily obfuscated and hidden after long runs of whitespace; later stages were encrypted with XOR.T1041 · Exfiltration Over C2 ChannelThe stealer uploaded collected archives to attacker-controlled upload endpoints, with Telegram as a fallback.T1059.006 · PythonThe payload used a Python credential stealer and attempted to make Python available on victim systems.T1059.007 · JavaScriptObfuscated JavaScript in affected package files ran when an application imported the package.T1071.001 · Web ProtocolsThe malware reported status and communicated with its RAT and upload servers over HTTP or Socket.IO.T1105 · Ingress Tool TransferThe bootstrapper downloaded Python support files and retrieved further payload stages through blockchain transaction data.T1195.002 · Compromise Software Supply ChainMalicious code was inserted into published npm package versions and, in 2026, into the maintainer's GitHub repositories through force-pushes.T1539 · Steal Web Session CookieThe stealer collected browser cookies from targeted browser profiles.T1555.003 · Credentials from Web BrowsersThe stealer extracted browser passwords and other browser data, using platform-specific encryption material.T1555.004 · Windows Credential ManagerThe stealer enumerated Windows Credential Manager entries.T1555.005 · Password ManagersThe stealer collected data from 1Password and Dashlane.T1560.001 · Archive via UtilityThe stealer staged collected data in AES-encrypted ZIP archives before exfiltration.
Threat Actors
Malware
InvisibleFerretThe payload: JADESNOW, an INVISIBLEFERRET bootstrapper, a Socket.IO RAT, and a Python credential stealer, delivered through BNB Smart Chain and Ethereum transactions.JADESNOWThe payload: JADESNOW, an INVISIBLEFERRET bootstrapper, a Socket.IO RAT, and a Python credential stealer, delivered through BNB Smart Chain and Ethereum transactions.PolinRiderJavaScript files and hidden by hundreds of whitespace characters. That pattern looked a lot like the PolinRider campaign, which had no documented victims before January 2026. Like an insect trapped in amber, we
Products
BNB Smart ChainThe payload: JADESNOW, an INVISIBLEFERRET bootstrapper, a Socket.IO RAT, and a Python credential stealer, delivered through BNB Smart Chain and Ethereum transactions.EthereumThe payload: JADESNOW, an INVISIBLEFERRET bootstrapper, a Socket.IO RAT, and a Python credential stealer, delivered through BNB Smart Chain and Ethereum transactions.GitHubPolinRider’s payload but not its documented spread behavior, which appears in the same maintainer’s GitHub repositories in four windows between January and July 2026. The blockchain records behind it dateNode.jsStage 4A Node.js RATnpmsince August 2018. Then, at 20:15 UTC on Sunday, May 4, 2025, an attacker published version 1.4.2 on npm. Over the next 90 minutes, versions of eight more npm packages from the same maintainer followed. EveryTelegramSome payloads send data through a Telegram bot