Hackers Hijack 10 npm Packages to Spread PolinRider Malware Using Ethereum Blockchain

Cybersecuritynews •Kavichselvan • November 9, 2026

Attackers have taken over 10 npm packages and slipped hidden code into 12 releases. The code uses the Ethereum blockchain to find a server and download more malware. Sonatype Research Labs confirmed the finding on November 4, 2026, and tracks it as sonatype-2026-010515, with a high severity score of 8.7. PolinRider malware The hijacked packages […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PolinRider Malware Targets npm Packages with Concealed Loaders On November 4, 2026, Sonatype Research Labs identified concealed JavaScript loaders in 12 npm releases across 10 hijacked packages, linking the compromise to previously documented PolinRider activity. These loaders utilize Ethereum transactions to locate remote payload servers and execute malicious code within developer environments and applications. The affected packages include tools for Redux integration, health APIs, and browser activity tracking, with no consumer install or postinstall hooks present. The malicious code can execute when an affected entrypoint is loaded or when specific applications start. Sonatype has classified this finding as sonatype-2026-010515. Security professionals are advised to check dependencies and treat any affected hosts as compromised. The attack method involves querying Ethereum RPC endpoints to retrieve payload-server IP addresses from transactions sent by a hard-coded wallet. No CVEs have been reported for this incident yet. 3 sources 43

Extracted Entities

Hackers Hijack 10 npm Packages to Spread PolinRider Malware Using Ethereum Blockchain

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Companies (1)