HighAPT
Hackers Hijack 10 npm Packages to Spread PolinRider Malware Using Ethereum Blockchain
Cyber Security News·Source published ·1 min read
What happened?
Attackers have taken over 10 npm packages and slipped hidden code into 12 releases. The code uses the Ethereum blockchain to find a server and download more malware. Sonatype Research Labs confirmed the finding on November 4, 2026, and tracks it as sonatype-2026-010515, with a high severity score of 8.7. PolinRider malware The hijacked packages do very different jobs. Some help with Redux, health APIs and browser activity tracking. Others offer utilities and server examples.
Key details
- Attackers hijacked 10 npm packages and inserted malicious code into 12 releases.
- The malicious code uses the Ethereum blockchain to locate a command-and-control server.
- Each loader queries public Ethereum RPC servers for a transaction from wallet 0x1eef0849eda15d87f64e51c73c8442cf3c8bcef3.
- The loader extracts two IPv4 addresses from the transaction recipient address bytes.
- Malware downloads XOR-encoded JavaScript over plain HTTP on port 443 using paths /0x/cls and /0x/ls.
- The same Ethereum wallet appears in earlier PolinRider and GhostAction campaigns, suggesting shared infrastructure.
Affected
- @adminide-stack/client-redux
- @adminide-stack/health-api-server
- @adminide-stack/user-activity-browser
- @adminide-stack/forms-core
- @adminide-stack/yantra-help-browser
- @pubngo-stack/help-browser
Fixes and mitigations
- Rotate any secrets the compromised process could access, including npm tokens, repository access, cloud keys, and CI secrets.
What to look for
- Detached node -i processes started by another Node process.
- Plain HTTP requests to port 443 using paths /0x/cls or /0x/ls.
- Sec-V header values A10-npm_inject, A10-II, or A10-E in payload requests.
- Ethereum wallet 0x1eef0849eda15d87f64e51c73c8442cf3c8bcef3 used as resolver.
- Server IP 95.135.181.151 observed in wallet transactions on November 3.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.