PolinRider loader uses Ethereum transactions as C2 resolver in 35 GitHub repositories, including a pull request to oxc

Linha do tempo

1. safedep.io ↗ · pub. 29/09/2026 21:00 · coletado 19/10 18:03 primeiro registro

   PolinRider loader uses Ethereum transactions as C2 resolver in 35 GitHub repositories, including a pull request to oxc

   ler a análise desta fonte ocultar

   SafeDep reports that the PolinRider loader family now resolves its C2 servers from Ethereum mainnet. The loader reads small transactions from operator wallets and decodes the recipient address as an IP:port. SafeDep confirmed 35 GitHub repositories carrying the loader at HEAD on 2026-09-30 (7,578 stars and 2,884 forks combined). The investigation began with a malicious pull request to oxc-project/oxc that injected the loader into 20 build and test scripts. The maintainers did not merge it, and the payload became visible only because an autofix bot reformatted it. The loader runs on build or start and installs a Node.js and Python infostealer targeting environment secrets, browser passwords, cookies and crypto wallet data.

   Technical Details

   • Delivery: the oxc PR commit 41ab07a8 used a spoofed maintainer author name and a back-dated author date. The payload sat after 2,000 spaces on the last line of each file. TypeScript files carry it as Base64 inside eval(atob(...)). The same technique appears in infected templates and starter kits, including four Creative Tim dashboards (1,773 forks).
   • C2 resolution: the loader queries public RPC endpoints (eth.drpc.org, eth-mainnet.public.blastapi.io, ethereum-rpc.publicnode.com) for a transaction from wallet 0x33ff3eda…9891, searching back through 256-block windows. The to address encodes two IP:port pairs (e.g. 198.105.127[.]210:443 and 45.137.198[.]133:80). That wallet sent 2,895 transactions from 2026-06-23, roughly one every 51 minutes.
   • Second wallet: 0xa322E5f3…Ef1a has sent 491 transactions since 2026-07-25 and uses six C2 servers on AS149440 Evoxt. It has a different loader, using the Blockscout API and a helloipbot!! suffix. It appears in 70 OpenSSF malicious-packages records (68 npm, 2 PyPI), mostly look-alike Tailwind CSS and PostCSS plugins. One infection also writes a Tron-based loader (TCqf6ZkaQD84vYsC2cuu1jRwB6JveTaRrF) alongside the Ethereum one.
   • Execution: the loader silences console output and fetches /boot with an X: <32-hex>:<marker> header. It runs the response through eval and a detached node -e process, and on WSL2 also starts node.exe on the Windows host.
   • Stealer: the stage installs axios and socket.io-client into ~/.node_modules and posts process.env to /snv. It skips CI and sandbox hostnames and installs Python with a pip bootstrap. It then runs an 83 KB Python stealer that collects Chromium and Firefox passwords and cookies, ~/.git-credentials and data from 153 wallet and password-manager extensions. Data is uploaded as a ZIP to /u/f, with the Telegram Bot API as fallback.
   • Overlap: C2 servers 198.105.127[.]210 and 166.88.134[.]62 also appear in earlier SafeDep investigations (astro.config.mjs and @joyfill).

   Remediation

   • Treat any machine that built, ran or tested a cloned or forked affected project as compromised. Rotate all shell-environment secrets, browser-saved passwords and session cookies, and move funds out of wallet extensions.
   • Hunt for ~/.node_modules, ~/.local/bin/py, /tmp/.pip, tmp7A863DD1.tmp, and detached node -e or python -c processes.
   • Repository owners should remove the payload from all JS/TS files and clean the developer machines that pushed to the repository, otherwise reinfection follows.
   • Detect Node processes that query public Ethereum RPC or Blockscout endpoints and then connect to a raw IP on port 80 or 443, and grep for lines over 1,000 characters, global.o=', global.i="A and createRequire(import.meta.url). Also review commits where author and committer differ, and font files that are actually JavaScript.