PolinRider Malware Returns in 10 Hijacked npm Packages Using Ethereum Blockchain to Deliver Malicious Code

Gbhackers •Mayura Kathir • November 9, 2026

A concealed JavaScript loaders in 12 releases across 10 hijacked npm packages, linking the compromise to previously documented PolinRider activity. Investigated on November 4, 2026, the releases use Ethereum transactions to discover remote payload servers and execute downloaded code inside developer environments, build systems, or applications. Sonatype tracks the finding as sonatype-2026-010515.guide. Unlike installation-triggered supply-chain […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PolinRider Malware Targets npm Packages with Concealed Loaders On November 4, 2026, Sonatype Research Labs identified concealed JavaScript loaders in 12 npm releases across 10 hijacked packages, linking the compromise to previously documented PolinRider activity. These loaders utilize Ethereum transactions to locate remote payload servers and execute malicious code within developer environments and applications. The affected packages include tools for Redux integration, health APIs, and browser activity tracking, with no consumer install or postinstall hooks present. The malicious code can execute when an affected entrypoint is loaded or when specific applications start. Sonatype has classified this finding as sonatype-2026-010515. Security professionals are advised to check dependencies and treat any affected hosts as compromised. The attack method involves querying Ethereum RPC endpoints to retrieve payload-server IP addresses from transactions sent by a hard-coded wallet. No CVEs have been reported for this incident yet. 3 sources 43

Extracted Entities

PolinRider Malware Returns in 10 Hijacked npm Packages Using Ethereum Blockchain to Deliver Malicious Code

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

MITRE ATT&CK (1)

Tools (1)