Attackers hijacked legitimate npm packages and hid their command-and-control instructions inside the Ethereum blockchain. The campaign, linked to the PolinRider malware family, placed a concealed loader in 12 malicious releases across 10 hijacked packages, according to Sonatype Research Labs, with OX Security's analysis published on 4 November 2026.

The affected packages include six modules under @adminide-stack, plus server-hemera-mongo, cdeops, @cdmbase/wiki-browser and @pubngo-stack/help-browser. Together they account for about 1,400 weekly downloads — download activity, not confirmed infections. All of the malicious versions have been taken down from the npm registry.

Unlike typical malicious packages, these releases contain no install or post-install scripts, so disabling npm installation scripts does not stop them. The loader runs when an application imports an affected module or starts a bundled service, hiding behind Base64-encoded JavaScript or a character-permutation bootstrap.

A blockchain dead drop for the command server

Once triggered, the loader queries public Ethereum RPC nodes to find transactions sent by a hard-coded wallet address. It turns the recipient address of the latest transaction into an IP address for its command server, then downloads an XOR-obfuscated JavaScript payload over HTTP and runs it in memory through an interactive Node.js process.

The operator can move the payload server by sending another Ethereum transaction, without touching the published packages. The decoded payload includes crypto-stealer logic and the attacker's Ethereum wallet address. Sonatype links all 12 releases to the PolinRider operation documented by GitGuardian on 27 October: they query the same Ethereum wallet and use the same fallback server address and retrieval paths seen in earlier GitHub compromises. Whether PolinRider shares an operator with the GhostAction campaign remains unconfirmed. Researchers advise auditing lockfiles for the compromised versions, and treating any host that imported an affected module as compromised, rotating its tokens, cloud keys and CI secrets.