Hackers Hijack 10 npm Packages to Spread PolinRider Malware Using Ethereum Blockchain
Attackers compromised 10 npm packages, using the Ethereum blockchain to dynamically fetch and deploy the PolinRider malware, bypassing traditional defenses.
A sophisticated campaign has seen attackers compromise ten npm packages, injecting malicious code into twelve different releases. These compromised packages, which serve various functions from Redux utilities to server examples, now employ a novel technique to download the PolinRider malware: leveraging the Ethereum blockchain. Sonatype Research Labs identified this threat, assigning it a high severity score of 8.7 and tracking it as sonatype-2026-010515.
The malicious code within the hijacked packages uses obfuscation techniques, including Base64 encoding and the JavaScript Function constructor, to hide its true purpose. Once executed, the code queries public Ethereum RPC servers, specifically looking for a transaction originating from a fixed wallet address (0x1eef0849eda15d87f64e51c73c8442cf3c8bcef3). This transaction's data is then used to derive an IPv4 address for a command-and-control (C2) server.
This blockchain-based C2 mechanism offers significant advantages to the attackers. By embedding the logic to fetch the next stage of the attack within the compromised package itself, they can update the C2 server address simply by posting a new transaction to the blockchain. This bypasses the need to modify or re-release the malicious npm packages, making it much harder for security teams to track and block the evolving infrastructure.
The malware then fetches XOR-encoded JavaScript from the identified C2 server over plain HTTP on port 443, using specific paths like '/0x/cls' and '/0x/ls'. The '/0x/cls' script is executed directly within the application and also in a detached Node.js process, while '/0x/ls' runs solely in the detached process, ensuring persistence even after the main application closes.
This attack vector is particularly concerning because it circumvents common security measures. Many development teams disable npm's pre-install or post-install hooks due to security risks. However, the malicious code in these packages runs when the package is loaded or the service starts, not during installation, rendering script disabling ineffective. This highlights a shift in malware distribution tactics within the open-source ecosystem.
Researchers have noted similarities between this campaign and previous PolinRider activity. The same wallet address used for the Ethereum lookup has been previously linked to PolinRider loaders found in compromised GitHub repositories. While attribution remains cautious, the shared infrastructure and techniques suggest a connection, potentially indicating a single operator or a group adopting established PolinRider methods.
To mitigate this threat, organizations are advised to meticulously search their lock files (package-lock.json, yarn.lock, pnpm-lock.yaml) and internal repositories for the twelve identified malicious releases. Affected hosts should be treated as compromised, with investigations focusing on detached Node.js processes and suspicious HTTP requests to port 443. Rotating any secrets accessible by the affected processes is also a critical step to prevent further compromise.