Skip to content
PolinRider Malware Targets npm Packages with Concealed Loaders

PolinRider Malware Targets npm Packages with Concealed Loaders

First seen 9 Nov 2026, 16:43 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 9, 2026 at 16:44 UTC
  • •12 npm releases across 10 packages contain concealed JavaScript loaders.
  • •Loaders use Ethereum transactions to execute malicious code in developer environments.
  • •No consumer-side installation scripts are required for the malicious code to run.

On November 4, 2026, Sonatype Research Labs identified concealed JavaScript loaders in 12 npm releases across 10 hijacked packages, linking the compromise to previously documented PolinRider activity. These loaders utilize Ethereum transactions to locate remote payload servers and execute malicious code within developer environments and applications. The affected packages include tools for Redux integration, health APIs, and browser activity tracking, with no consumer install or postinstall hooks present. The malicious code can execute when an affected entrypoint is loaded or when specific applications start. Sonatype has classified this finding as sonatype-2026-010515. Security professionals are advised to check dependencies and treat any affected hosts as compromised. The attack method involves querying Ethereum RPC endpoints to retrieve payload-server IP addresses from transactions sent by a hard-coded wallet. No CVEs have been reported for this incident yet.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 1d ago How this analysis works

Timeline

2026-11-04
Sonatype identifies malicious loaders
Sonatype Research Labs confirmed concealed JavaScript loaders in 12 npm releases linked to PolinRider activity.
Sonatype

More articles in this cluster (3)

Following this threat?

Track Ethereum in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (9)

1 / 3

Common questions

Which npm packages are affected?
The attack involves 12 npm releases across 10 hijacked packages, including tools for Redux and health APIs.
How does the malware execute?
The malware uses concealed JavaScript loaders that execute when an affected entrypoint is loaded.
What should I do if I'm affected?
Check your dependencies and treat any affected hosts as compromised, investigating their processes and network activity.