PolinRider loader hidden in 12 releases of 10 hijacked npm packages, using an Ethereum wallet as dead-drop C2 resolver

Linha do tempo

1. securityonline.info ↗ · pub. 06/11/2026 22:47 · coletado 06/11 23:00 primeiro registro

   PolinRider loader hidden in 12 releases of 10 hijacked npm packages, using an Ethereum wallet as dead-drop C2 resolver

   ler a análise desta fonte ocultar

   Sonatype Research Labs reported on 4 November 2026 that 12 releases across 10 hijacked npm packages carry a concealed PolinRider runtime loader, tracked as sonatype-2026-010515 (sonatype.com). The affected packages cover Redux integration, health APIs, browser activity tracking, utilities and server examples, and include six @adminide-stack modules plus server-hemera-mongo, cdeops, @cdmbase/wiki-browser and @pubngo-stack/help-browser (sonatype.com). Unlike most malicious packages, none use install or postinstall hooks: the code runs when an application imports an injected entry file or when the bundled service starts, so disabling npm install scripts offers no protection. The loader resolves its command server from Ethereum transactions sent by a hard-coded wallet, then fetches, XOR-decodes and executes JavaScript in detached Node processes. Sonatype links the releases to PolinRider activity previously documented by GitGuardian (27 October 2026) and Greenflagged (3 November 2026) through the identical wallet, overlapping server infrastructure and matching stage paths, while stating that a shared operator with the GhostAction campaign is not established. Victim counts are undisclosed, but any developer workstation, CI worker, build host or production container that loaded an affected version should be considered fully compromised.

   Technical Details

   The loader queries public Ethereum RPC endpoints, with a Blockscout API fallback, for a transaction sent by wallet 0x1eef0849eda15d87f64e51c73c8442cf3c8bcef3; it reads the first four bytes of the recipient address as the primary IPv4 C2 and the next four as a secondary one (sonatype.com). It retrieves XOR-encoded JavaScript over plain HTTP on TCP/443 from the paths /0x/cls and /0x/ls, adding custom Sec-V headers such as A10-npm_inject, A10-II and A10-E. After decoding, the /0x/cls payload is passed to eval in the application process and piped into a detached node -i process, while the /0x/ls payload goes only to a detached node -i; the unreferenced children survive the parent application (sonatype.com). Two concealment variants exist: six releases wrap the loader in eval(atob(...)), six use a character-permutation bootstrap executed through the JavaScript Function constructor, with byte-identical decoded bodies and the same wallet, paths and XOR keys (sonatype.com). In [email protected] the bootstrap sits in client.js before the normal delegation, while the ES module client.mjs is clean; in server-hemera-mongo the injection is in dist/main.js, the bundle referenced by the start script (sonatype.com). Greenflagged decoded the wallet's transactions and reported 95.135.181.151 as the advertised C2 on 3 November 2026, an address GitGuardian had already listed on port 443 as a PolinRider fallback C2 (sonatype.com). Affected releases are @adminide-stack/client-redux 0.0.16-18, health-api-server 0.0.18-alpha.465, user-activity-browser 1.1.3-alpha.114, utils 0.0.16-129 and 0.0.16-130, forms-core 5.1.9-alpha.3, yantra-help-browser 12.0.194, server-hemera-mongo 0.0.15 and 0.0.16, cdeops 13.5.31, @cdmbase/wiki-browser 12.0.18-alpha.53 and @pubngo-stack/help-browser 12.0.23-alpha.3 (sonatype.com).

   Remediation

   Audit direct and transitive dependencies, package-lock.json, yarn.lock, pnpm-lock.yaml, internal npm mirrors, caches, build records and artifact metadata for the 12 compromised versions, and block them in the repository manager or dependency firewall (sonatype.com). Because execution is at runtime, correlate dependency records with build commands, process telemetry and runtime logs to determine whether an injected file actually loaded. Hunt for detached interactive Node child processes receiving piped standard input and for plain HTTP traffic over port 443 carrying Sec-V headers. Treat any host that executed an affected module as compromised and rotate all repository tokens, cloud keys and CI secrets reachable from that environment. Blocking a single C2 IP is insufficient, since the operator can advertise a new address with another Ethereum transaction (sonatype.com).