PolinRider loader infects 10 hijacked npm packages

Sonatype Research Labs identified a concealed PolinRider loader inside 12 releases across 10 hijacked npm packages, with the loader executing not at install-time but when an application imports the affected module or starts a bundled service. The campaign targets packages including six @adminide-stack modules, server-hemera-mongo, cdeops, @cdmbase/wiki-browser, and @pubngo-stack/help-browser.

The researchers note that although total victim counts are not disclosed, any developer workstation, build server or production container that imports these specific versions risks full compromise.

Infection proceeds without install or postinstall scripts; the loader runs when Node loads an injected entry file or the main service bundle. The 12 builds employ two methods: six releases wrap the loader in Base64 and execute via eval, and the other six use a character-permutation bootstrap that scrambles a text blob and runs it through the JavaScript Function constructor.

Once triggered, the loader queries public Ethereum RPC nodes or a Blockscout API fallback to locate transactions from a hardcoded wallet address. It reads the first four bytes of the recipient address as the primary IPv4 command server and the next four as a backup; the wallet acts as a dead-drop resolver to advertise a new payload server via subsequent transactions. The loader then contacts the resolved IP on port 443, reads responses, XOR-decodes payloads, and runs them in detached Node processes.

Attribution is confirmed: all 12 releases match the same Ethereum wallet, server IP, and stage paths seen in earlier GhostAction and PolinRider activity, tying the npm campaign to the PolinRider operation per GitGuardian and Greenflagged analyses, though a single shared operator remains unconfirmed. Defenders should audit lockfiles for the affected versions and monitor for runtime imports and suspicious HTTP traffic with Sec-V headers.