EN PT-BR
← Voltar ao feed
critical technology software_development

PolinRider loader found in 12 releases of 10 hijacked npm packages, using an Ethereum wallet as dead-drop C2 resolver

2 fonte(s) · 2 atualização(ões) · publicado 06/11/2026 22:47 · coletado há 8 horas

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 09/11/2026 12:13; os links antigos trazem para cá.

Fontes: gbhackers.com ↗ securityonline.info ↗

Sonatype Research Labs reported on 4 November 2026 that 12 releases across 10 hijacked npm packages carry a concealed PolinRider runtime loader, tracked as sonatype-2026-010515 (sonatype.com via securityonline.info). The affected packages cover Redux integration, health APIs, browser activity tracking, utilities and server examples. They include six @adminide-stack modules plus server-hemera-mongo, cdeops, @cdmbase/wiki-browser and @pubngo-stack/help-browser (securityonline.info). None of the packages use install or postinstall hooks. The code runs when an application imports an injected entry file or when the bundled service starts, so disabling npm install scripts gives no protection (securityonline.info, gbhackers.com). Sonatype links the releases to PolinRider activity documented earlier by GitGuardian (27 October 2026) and Greenflagged (3 November 2026), based on the identical wallet, overlapping server infrastructure and matching stage paths. It states that a shared operator with the GhostAction campaign is not established (securityonline.info). Victim counts are undisclosed. Any developer workstation, CI worker, build host or production container that loaded an affected version should be treated as fully compromised (securityonline.info).

Detalhes técnicos

  • C2 resolution: The loader queries public Ethereum RPC endpoints, with a Blockscout API fallback, for a transaction sent by wallet 0x1eef0849eda15d87f64e51c73c8442cf3c8bcef3. It reads the first four bytes of the recipient address as the primary IPv4 C2 and the next four as a secondary one (securityonline.info, gbhackers.com). Because the infrastructure is redirected by publishing a new transaction, blocking one server does not stop replacement discovery (gbhackers.com).
  • Payload retrieval: It fetches XOR-encoded JavaScript over plain HTTP on TCP/443 from the paths /0x/cls and /0x/ls, with custom Sec-V headers such as A10-npm_inject, A10-II and A10-E (securityonline.info).
  • Execution: The decoded /0x/cls payload goes to eval in the application process and is also piped into a detached node -i process. The /0x/ls payload goes only to a detached node -i. These unreferenced children survive the parent application (securityonline.info, gbhackers.com).
  • Concealment: Six releases wrap the loader in eval(atob(...)). Six use a character-permutation bootstrap run through the JavaScript Function constructor. The decoded bodies are byte-identical, with the same wallet, paths and XOR keys (securityonline.info, gbhackers.com).
  • Injection points: In [email protected] the bootstrap sits in client.js before the normal delegation, while the ES module client.mjs is clean. In server-hemera-mongo the injection is in dist/main.js, the bundle referenced by the start script (securityonline.info).
  • Known C2: Greenflagged decoded the wallet's transactions and reported 95.135.181.151 as the advertised C2 on 3 November 2026. GitGuardian had already listed this address on port 443 as a PolinRider fallback C2 (securityonline.info).
  • Later stages: Greenflagged reported that later stages install a Node remote-access trojan. It persists through npm's lib/cli.js and desktop application startup files, targeting VS Code, Cursor, Discord and GitHub Desktop (gbhackers.com).
  • Affected releases: The securityonline.info text lists @adminide-stack/client-redux 0.0.16-18 and health-api-server 0.0.18 onward, but it is truncated. The full version list is not available in the sources.

Remediação

  • Inspect direct and transitive dependencies, lockfiles, mirrors, caches and build records for all 12 releases (gbhackers.com).
  • Correlate affected entrypoints with process telemetry and outbound traffic, especially detached Node processes and unexpected HTTP on port 443 (gbhackers.com).
  • If injected code executed, isolate the host, preserve evidence, investigate persistence and rotate all accessible credentials. Removing the package does not reverse an established compromise (gbhackers.com).
  • Do not rely on disabling npm install scripts, since the loader does not use them (securityonline.info).

Relatos divergentes

The sources agree on the core facts. The only discrepancy is the tracking identifier: securityonline.info gives sonatype-2026-010515, while gbhackers.com renders it as sonatype-2026-010515.guide. The version without the suffix is more consistent with the primary Sonatype reporting as relayed by securityonline.info, which is also the earlier source.

Linha do tempo

  1. gbhackers.com ↗ · pub. 09/11/2026 04:17 · coletado 09/11 05:00

    PolinRider loaders hidden in 12 releases of 10 hijacked npm packages use Ethereum transactions as dead-drop C2

    ler a análise desta fonte

    Concealed JavaScript loaders were found in 12 releases across 10 hijacked npm packages, linking the compromise to previously documented PolinRider activity (per gbhackers.com, citing Sonatype, tracked as sonatype-2026-010515.guide). The loaders query public Ethereum RPC endpoints, falling back to Blockscout, for transactions sent by wallet 0x1eef0849eda15d87f64e51c73c8442cf3c8bcef3, decoding IPv4 addresses from the recipient address bytes to reach remote servers. The packages have no install or postinstall hooks, so the code runs when an affected entrypoint loads, and disabling npm install scripts does not neutralize it. Because the infrastructure is redirected by publishing a new transaction, blocking one server does not stop replacement discovery.

    Technical Details

    The malware requests /0x/cls and /0x/ls over plain HTTP on TCP port 443, XOR-decodes the retrieved JavaScript, and executes the /0x/cls stage through eval inside the application and through a detached node -i process. The /0x/ls stage runs only in a detached child process fed through standard input. Six releases hide loaders inside eval(atob(...)), and six others reconstruct code through character permutation and an indirect Function constructor call. Greenflagged reported that later stages install a Node remote-access trojan with persistence through npm's lib/cli.js and desktop application startup files, targeting VS Code, Cursor, Discord and GitHub Desktop (gbhackers.com).

    Remediation

    • Inspect direct and transitive dependencies, lockfiles, mirrors, caches and build records for all 12 releases.
    • Correlate affected entrypoints with process telemetry and outbound traffic, especially detached Node processes and unexpected HTTP on port 443.
    • If injected code executed, isolate the host, preserve evidence, investigate persistence and rotate accessible credentials. Removing the package does not reverse an established compromise.
  2. securityonline.info ↗ · pub. 06/11/2026 22:47 · coletado 06/11 23:00 primeiro registro

    PolinRider loader hidden in 12 releases of 10 hijacked npm packages, using an Ethereum wallet as dead-drop C2 resolver

    ler a análise desta fonte

    Sonatype Research Labs reported on 4 November 2026 that 12 releases across 10 hijacked npm packages carry a concealed PolinRider runtime loader, tracked as sonatype-2026-010515 (sonatype.com). The affected packages cover Redux integration, health APIs, browser activity tracking, utilities and server examples, and include six @adminide-stack modules plus server-hemera-mongo, cdeops, @cdmbase/wiki-browser and @pubngo-stack/help-browser (sonatype.com). Unlike most malicious packages, none use install or postinstall hooks: the code runs when an application imports an injected entry file or when the bundled service starts, so disabling npm install scripts offers no protection. The loader resolves its command server from Ethereum transactions sent by a hard-coded wallet, then fetches, XOR-decodes and executes JavaScript in detached Node processes. Sonatype links the releases to PolinRider activity previously documented by GitGuardian (27 October 2026) and Greenflagged (3 November 2026) through the identical wallet, overlapping server infrastructure and matching stage paths, while stating that a shared operator with the GhostAction campaign is not established. Victim counts are undisclosed, but any developer workstation, CI worker, build host or production container that loaded an affected version should be considered fully compromised.

    Technical Details

    The loader queries public Ethereum RPC endpoints, with a Blockscout API fallback, for a transaction sent by wallet 0x1eef0849eda15d87f64e51c73c8442cf3c8bcef3; it reads the first four bytes of the recipient address as the primary IPv4 C2 and the next four as a secondary one (sonatype.com). It retrieves XOR-encoded JavaScript over plain HTTP on TCP/443 from the paths /0x/cls and /0x/ls, adding custom Sec-V headers such as A10-npm_inject, A10-II and A10-E. After decoding, the /0x/cls payload is passed to eval in the application process and piped into a detached node -i process, while the /0x/ls payload goes only to a detached node -i; the unreferenced children survive the parent application (sonatype.com). Two concealment variants exist: six releases wrap the loader in eval(atob(...)), six use a character-permutation bootstrap executed through the JavaScript Function constructor, with byte-identical decoded bodies and the same wallet, paths and XOR keys (sonatype.com). In [email protected] the bootstrap sits in client.js before the normal delegation, while the ES module client.mjs is clean; in server-hemera-mongo the injection is in dist/main.js, the bundle referenced by the start script (sonatype.com). Greenflagged decoded the wallet's transactions and reported 95.135.181.151 as the advertised C2 on 3 November 2026, an address GitGuardian had already listed on port 443 as a PolinRider fallback C2 (sonatype.com). Affected releases are @adminide-stack/client-redux 0.0.16-18, health-api-server 0.0.18-alpha.465, user-activity-browser 1.1.3-alpha.114, utils 0.0.16-129 and 0.0.16-130, forms-core 5.1.9-alpha.3, yantra-help-browser 12.0.194, server-hemera-mongo 0.0.15 and 0.0.16, cdeops 13.5.31, @cdmbase/wiki-browser 12.0.18-alpha.53 and @pubngo-stack/help-browser 12.0.23-alpha.3 (sonatype.com).

    Remediation

    Audit direct and transitive dependencies, package-lock.json, yarn.lock, pnpm-lock.yaml, internal npm mirrors, caches, build records and artifact metadata for the 12 compromised versions, and block them in the repository manager or dependency firewall (sonatype.com). Because execution is at runtime, correlate dependency records with build commands, process telemetry and runtime logs to determine whether an injected file actually loaded. Hunt for detached interactive Node child processes receiving piped standard input and for plain HTTP traffic over port 443 carrying Sec-V headers. Treat any host that executed an affected module as compromised and rotate all repository tokens, cloud keys and CI secrets reachable from that environment. Blocking a single C2 IP is insufficient, since the operator can advertise a new address with another Ethereum transaction (sonatype.com).