Researchers Link Loaders in 12 Hijacked npm Releases to PolinRider Activity
Summary
Sonatype found concealed loaders in 12 releases across 10 hijacked npm packages. They use Ethereum transactions to locate and execute remote JavaScript; shared wallet, infrastructure, and retrieval paths support a link to PolinRider activity.
Key points
- Sonatype Research Labs identified 12 affected releases across 10 hijacked npm packages and tracks the finding as sonatype-2026-010515.
- The loaders use one hard-coded Ethereum wallet as a dead-drop resolver, decoding payload-server IP addresses from its transactions.
- They retrieve XOR-encoded JavaScript over plain HTTP on TCP port 443, then execute it in the application or detached Node.js processes.
- Six releases conceal the loader with eval(atob(...)); six use an obfuscated character-permutation bootstrap and the JavaScript Function constructor.
- Package manifests show no consumer install or postinstall hooks; execution can occur when affected code is loaded or, for server-hemera-mongo, when the application starts.
- A matching wallet, retrieval paths, and overlapping server infrastructure support linking the releases to previously documented PolinRider activity, but do not establish that PolinRider and GhostAction share an operator.
- Sonatype advises checking dependency records and execution evidence; if affected code ran, investigate host activity and accessible credentials, and rotate credentials where exposure is possible.
Article Details
- Attack Vectors
- Malicious loaders were embedded in 12 releases across 10 hijacked npm packages and could execute when an affected package entrypoint was loaded; the server-hemera-mongo releases could execute when the application started.
- The loaders queried public Ethereum RPC endpoints, with a Blockscout API fallback, to resolve payload-server addresses from transactions sent by a hard-coded wallet.
- The loaders retrieved JavaScript over plain HTTP on TCP port 443 from /0x/cls and /0x/ls, XOR-decoded it, and executed it with eval or in detached node -i processes.
- Loader code was concealed using eval(atob(...)) or a character-permutation bootstrap that invoked the JavaScript Function constructor.
- Defensive Notes
- Check direct and transitive dependencies, lockfiles, internal npm mirrors, caches, build records, and artifact metadata for the affected releases; block them from future use and replace them with independently verified clean versions.
- Determine whether affected entrypoints ran by correlating application configuration, build commands, process telemetry, network activity, and runtime logs. A lockfile entry alone does not prove execution.
- If affected code ran, treat the host as compromised. Investigate detached node -i processes launched by another Node process with piped standard input, and requests to TCP port 443 using /0x/cls or /0x/ls.
- Assess which credentials and systems were accessible to affected processes, and rotate credentials where exposure is possible, including publishing credentials, repository access, cloud keys, and CI secrets.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 95[.]135[.]181[.]151 | Reported payload-server C2 address advertised by a transaction from the loader's hard-coded Ethereum wallet; also reported as a fallback C2 in earlier PolinRider activity. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe loaders concealed code with Base64 or character-permutation bootstraps and used XOR-encoded payloads.T1059.007 · JavaScriptThe loader executed retrieved JavaScript using eval and the Function constructor, and launched detached node -i processes.T1071.001 · Web ProtocolsPayload retrieval used plain HTTP over TCP port 443.T1102.001 · Dead Drop ResolverThe loader used Ethereum transactions sent by a hard-coded wallet as a dead-drop resolver for payload-server addresses.T1105 · Ingress Tool TransferThe loader retrieved JavaScript payloads from the resolved payload-server address using /0x/cls and /0x/ls.T1140 · Deobfuscate/Decode Files or InformationThe loaders decoded embedded bootstraps and XOR-decoded retrieved JavaScript before execution.T1195.001 · Compromise Software Dependencies and Development ToolsMalicious loaders were distributed in hijacked npm package releases, compromising software dependencies.