VULNpocalypse
HighSupply chainActive

Sonatype reports PolinRider loader in 12 hijacked npm package releases

Sonatype reports concealed PolinRider loaders in 12 hijacked npm releases; check lockfiles and mirrors and remove the affected versions.

Published
Exploitation
No confirmed victims reported; Sonatype reports malicious loaders in 12 published npm releases, but downstream impact is not confirmed

What happened

According to Sonatype, its Research Labs found concealed runtime loaders in 12 npm releases across 10 hijacked packages on November 4, 2026. Sonatype tracks the finding as sonatype-2026-010515. This advisory relies on that single report. No other outlet has independently verified the findings, and the package maintainers have not issued a confirmed statement in the sources.

Sonatype says all 12 releases contain loaders that query public Ethereum RPC endpoints, with a Blockscout API fallback, to find a transaction sent by the hard-coded wallet 0x1eef0849eda15d87f64e51c73c8442cf3c8bcef3. Sonatype reports that the loader reads the transaction’s recipient address as a primary and a secondary IPv4 address. It then fetches XOR-encoded JavaScript over plain HTTP on TCP port 443 from the paths /0x/cls and /0x/ls, decodes it and executes it. Sonatype says the code runs through eval in the application process and in detached node -i child processes that can keep running after the application exits (Sonatype).

Sonatype describes the wallet as a dead-drop resolver. The operator can advertise a new payload server by sending another transaction, so blocking one server IP does not stop the loader from finding a replacement (Sonatype).

Sonatype says six releases hide the loader in eval(atob(...)). The other six use a character-permutation bootstrap and the JavaScript Function constructor. Both variants use the same wallet, retrieval paths and XOR keys (Sonatype).

Sonatype links the releases to earlier PolinRider activity based on three points:

  • The same wallet appears in an October 27, 2026 GitGuardian report about PolinRider loaders in compromised GitHub repositories.
  • The /0x/cls and /0x/ls paths on port 443 match those earlier loaders.
  • Greenflagged reported 95.135.181.151 as the C2 address advertised by the wallet at its November 3 observation, an IP that GitGuardian had already listed as a PolinRider fallback C2.

Sonatype states that this does not establish that PolinRider and GhostAction share an operator (Sonatype).

The following details are not confirmed in the sources:

  • How the packages were hijacked.
  • Whether npm has removed the releases.
  • How many times the releases were downloaded.
  • What the retrieved payloads do.

Am I affected?

Sonatype lists these affected releases (Sonatype):

  • @adminide-stack/client-redux 0.0.16-18
  • @adminide-stack/health-api-server 0.0.18-alpha.465
  • @adminide-stack/user-activity-browser 1.1.3-alpha.114
  • @adminide-stack/utils 0.0.16-129, 0.0.16-130
  • server-hemera-mongo 0.0.15, 0.0.16
  • cdeops 13.5.31
  • @adminide-stack/forms-core 5.1.9-alpha.3
  • @adminide-stack/yantra-help-browser 12.0.194
  • @cdmbase/wiki-browser 12.0.18-alpha.53
  • @pubngo-stack/help-browser 12.0.23-alpha.3

Sonatype says the manifests have no install or postinstall hooks. The code runs when an affected entrypoint is loaded:

  • cdeops: require(‘cdeops/client’) loads the injected client.js. The ES module import maps to a separate client.mjs file.
  • server-hemera-mongo: the code runs when the bundled dist/main.js starts.

Disabling npm install scripts therefore does not prevent execution. According to Sonatype, the relevant question is whether affected code ran on a developer machine, CI worker, build host or deployed service.

What to do now

  1. Search for the listed versions. Check direct and transitive dependencies, package-lock.json, yarn.lock and pnpm-lock.yaml. Also check internal npm mirrors, caches, build records and artifact metadata (Sonatype).
  2. Review your repository manager or dependency firewall. Check download and policy logs to see whether any of the listed releases were delivered, and block all of them from future use (Sonatype).
  3. Remove the affected versions. Replace them in projects and stop mirrors and caches from serving them. Keep copies only as needed for investigation (Sonatype).
  4. Find out whether the code ran. Correlate lockfiles and download logs with build commands, application configuration, process telemetry and runtime logs (Sonatype).
  5. If affected code ran, treat the host as compromised. Investigate its processes, including detached node -i children, its network activity, such as HTTP on port 443 to addresses like 95.135.181.151, and the credentials it could access (Sonatype).

Sources