More than a dozen npm package versions were compromised by attackers who injected PolinRider malware, using the Ethereum blockchain as a manager for the malicious infrastructure. Security researchers flagged the threat on November 4, 2026, assigning it a high severity rating of 8.7.
The Attack Vector
The intruders took control of ten npm packages spanning utilities, Redux tools, APIs, and browser-tracking components. Among the compromised modules are @adminide-stack/client-redux, @adminide-stack/utils, cdeops, and server-hemera-mongo, along with tools for forms, wiki, and user activity tracking. Twelve specific releases carry hidden loaders that activate malicious behavior.
Detection was especially difficult because these loaders execute when the application loads the package — not during install hooks. Half of the bad builds hide code via Base64 and eval(atob(...)). The rest deploy character-permutation tricks with the Function constructor. For example, versions 0.0.16-129 through 0.0.16-130 of @adminide-stack/utils and version 13.5.31 of cdeops are known to be infected.
Command and Control via Ethereum
The novel piece: each loader reaches out to public Ethereum RPC servers to fetch a transaction from a designated wallet (0x1eef0849eda15d87f64e51c73c8442cf3c8bcef3). If that lookup fails, it falls back on the Blockscout API. From the transaction payload, the first four bytes encode a live IPv4 address; another four bytes give a backup. From there, the malicious code fetches XOR-encoded JavaScript from that IP over HTTP (on port 443) using specific paths: /0x/cls and /0x/ls. The former payload runs inside the app, the latter in a detached node -i process, meaning it can persist beyond the app’s lifecycle.
Unlike typical npm malware, which often uses install scripts to load malicious code, this strain activates on import — making disablement of install hooks ineffective. The compromised code within dist/main.js of server-hemera-mongo is executed when that service starts, for instance.
Historical Links & Persistence
Investigators found the same Ethereum wallet used across all infected releases. That wallet recently showed up in PolinRider loaders found in compromised GitHub repositories tied to a campaign known as GhostAction. That campaign has already affected tens of thousands of repos. Researchers caution that shared wallet usage does not confirm that the same actor is behind both PolinRider and GhostAction — copycat behavior is possible.
PolinRider’s roots date back to May 2025, according to malware analysts. Early attacks targeted npm packages and included payloads capable of remote access, browser and wallet theft, and even exfiltration of cloud storage files. More recent versions reportedly include trojans that try to persist through startup scripts for apps like VS Code, Discord, GitHub Desktop, and more.
What to Do Now
Anyone using Node.js ecosystems should proactively scan for the twelve infected package versions. Search through lockfiles—such as package-lock.json, yarn.lock, or pnpm-lock.yaml—build caches, internal registries, and mirrors. Revert to versions verified to be clean.
Importantly, check whether the infected code actually ran: examine entry-points, network logs, and look for detached node -i processes. Also search for HTTP requests to port 443 using /0x/cls or /0x/ls paths. If any indicators are present, assume compromise, rotate all credentials, secrets, and access tokens the process might have used. Monitoring package manifests alone isn’t enough.
Organizations should review and adopt detection procedures detailed in community guides provided by security analysts.
The use of public blockchains in managing malware callbacks is especially troubling. It makes takedowns harder, since bad actors only need to send new transactions to shift to a new command server. Blocking one IP or server doesn’t mitigate the risk.
Why This Matters
PolinRider’s growing sophistication—hiding code at import time, using blockchain for dynamic C2, evading typical defenses—illustrates how supply chain threats are evolving. Teams should rethink trust in open-source dependency models, elevate code auditing, and expand post-deployment monitoring. The blockchain layer here isn’t just a novelty—it enables unprecedented agility for attackers and persistent risk for defenders.
