PolinRider npm Malware: 10 Hijacked Packages Used Ethereum to Find Their Server, What Is Confirmed and What to Check
Attackers hid malicious code in 12 releases of 10 npm packages, using Ethereum to locate their server. npm removed the releases, but that does not clean a machine that already ran one.
Where Worldwide
On this page 8 sections
Attackers took over 10 packages on npm, the public library most JavaScript applications are built from, and hid malicious code in 12 releases on November 3 and 4, 2026. If a developer laptop or build server at your company, or at the agency that builds your website, installed and ran one of those releases, treat that machine as compromised, because removing the package from npm does not clean it up.
The packages are niche, so most companies will find nothing. The check is quick, and this attack gets past a protection many teams rely on.
What happened with the PolinRider npm packages
Greenflagged, which screens npm packages, published the first detailed account. Sonatype Research Labs confirmed the finding on November 4, tracks it as sonatype-2026-010515 and rates it High, 8.7.
According to Greenflagged, the first bad release went up at 22:00 UTC on November 3, the last at 07:28 UTC on November 4, and npm had removed all 12 by about 20:40 UTC on November 4. That is a window of under 23 hours. The npm registry record for @pubngo-stack/help-browser, checked November 9, no longer offers its malicious version.
These were not only obscure test builds. Greenflagged reports that the latest tag of @adminide-stack/utils moved to a malicious version, so a plain npm install of that package would have picked it up.
Which npm packages were hijacked
| Package | Malicious versions | Version before the bad release |
|---|---|---|
@adminide-stack/utils |
0.0.16-129, 0.0.16-130 | 0.0.16-128 |
@adminide-stack/client-redux |
0.0.16-18 | 0.0.16-17 |
@adminide-stack/health-api-server |
0.0.18-alpha.465 | 0.0.18-alpha.464 |
@adminide-stack/user-activity-browser |
1.1.3-alpha.114 | 1.1.3-alpha.113 |
@adminide-stack/forms-core |
5.1.9-alpha.3 | 5.1.9-alpha.2 |
@adminide-stack/yantra-help-browser |
12.0.194 | 12.0.193 |
server-hemera-mongo |
0.0.15, 0.0.16 | 0.0.11 |
cdeops |
13.5.31 | 13.5.29 |
@cdmbase/wiki-browser |
12.0.18-alpha.53 | 12.0.18-alpha.52 |
@pubngo-stack/help-browser |
12.0.23-alpha.3 | 12.0.23-alpha.2 |
The last column comes from Greenflagged. Verify a version independently before pinning to it.
How the malware uses the Ethereum blockchain
Each loader asks public Ethereum servers for the latest transaction sent by one fixed wallet, 0x1eef0849eda15d87f64e51c73c8442cf3c8bcef3, and reads its server address out of that transaction. Researchers call this a dead drop. The attacker can switch servers by posting another transaction, without publishing anything new to npm, so blocking one IP address is not a lasting fix.
Two details matter most for defenders:
- There is no install script. The code runs when the package is loaded or, for
server-hemera-mongo, when the app starts. Turning off install scripts would not have stopped it. - It outlives the app. Sonatype says the loader starts a detached
node -iprocess that can keep running after the application exits.
Greenflagged retrieved the next stage on November 4. It reports that this stage installs a remote-access trojan that can run commands, upload files and read the clipboard, and that it patches npm's own lib/cli.js, so every later npm command relaunches it. The trojan's code also lists startup files for VS Code, Cursor, Antigravity, Discord and GitHub Desktop as injection targets. Greenflagged read those capabilities from strings in the code and says it has not traced them all.
What is confirmed and what is not known about PolinRider
Confirmed: the 12 releases, the same wallet in all of them (Sonatype decoded each one), and the removal from npm.
Linked, but not proven: Sonatype connects these releases to PolinRider because the wallet and download paths match GitGuardian's October 27 report on loaders found in compromised GitHub repositories. GitGuardian notes PolinRider was originally attributed to a North Korean threat actor. None of these reports proves who published these releases. Sonatype also says the overlap does not establish that PolinRider and GhostAction, a separate GitHub campaign, share an operator.
Not known:
- How the
clockbook-appandpubngo-stackpublishing accounts were accessed. - How many machines ran the code. OX Security estimates about 1,400 combined weekly downloads across the packages it lists, and cautions that this is download activity, not confirmed infections.
- What the attacker's server delivers today, since it can change without a new release.
Two loose ends are worth including in your search. OX's table adds seven packages the other reports do not list, without explaining the connection: react-contact-forms, tailwindcss-form-utils, tailwind-contact-forms, tailwindcss-contact-form, tailwind-form-core, tailwind-input-kit and tailwind-forms-kit. And the OSV record MAL-2026-11986 for server-hemera-mongo also names version 0.0.12, which is not in Sonatype's list.
How to check for compromised npm dependencies this week
| Step | What to do | How to check |
|---|---|---|
| 1 | Find the versions | Search package-lock.json, yarn.lock, pnpm-lock.yaml, internal mirrors, caches and build records, including indirect dependencies |
| 2 | Block them | Block all 12 releases in your repository manager or dependency firewall, stop mirrors serving them, and keep a copy for investigators |
| 3 | Decide if the code ran | Match the entry point against process and network logs. A lockfile entry does not prove it ran, and an import error does not prove it did not |
| 4 | Inspect suspect machines without running npm | Run ls -la ~/.node_modules/.npm-ws*, search npm's lib/cli.js for M260630A and NPM_WS_SHIM, and look for *.inz.cjs, *.inz.orig or *.inz.tmp files. Greenflagged says any of those leftover files means the next stage ran |
| 5 | Check editors and apps | Search the VS Code, Cursor, Antigravity, Discord and GitHub Desktop startup files for markers such as RS260605 |
| 6 | Review processes and traffic | Look for a node -i child with piped input whose parent is another Node process, plain HTTP on port 443 to /0x/cls or /0x/ls, a Sec-V request header, and connections to 95.135.181.151 |
| 7 | Rotate secrets | If the code ran, rotate npm publishing tokens, source repository access, cloud keys and CI secrets that machine could reach, and treat any crypto wallets on it as exposed. Do this from a clean machine |
| 8 | Slow down new releases | Pin dependencies to verified versions and consider a minimum package-age rule, as OX recommends |
The warning in step 4 matters: Greenflagged cautions that running npm on a patched machine relaunches the implant. Rebuilding a confirmed host is safer than trying to clean it.
Why a hijacked npm package matters for a company network or website
You may not employ a single developer and still be exposed. If an agency, contractor or software vendor builds your website or app, their machines and build servers hold keys to your code, your cloud accounts and your live site. A trojan on one of those machines can reach all of that without touching your office network.
Ask anyone who builds software for you three questions: did you check for these releases, do you hold new package versions before using them, and which of our secrets live on your build systems? A clear answer costs them minutes.
PolinRider npm malware questions people are asking
What is PolinRider?
PolinRider is the name researchers use for a malware campaign aimed at software developers. GitGuardian describes a multi-stage chain ending in a Python stealer that targets browser data and crypto wallets.
Which npm packages were compromised?
Ten packages across 12 releases, listed in the table above. Most carry the @adminide-stack name, along with server-hemera-mongo, cdeops, @cdmbase/wiki-browser and @pubngo-stack/help-browser.
Does disabling npm install scripts stop this malware?
No. These releases have no install hooks. The code runs when the package is loaded.
Am I safe now that npm removed the packages?
Only if the code never ran on your systems and no mirror or cache still serves it. Removal from npm does not undo anything already installed on a machine.
Who is behind the npm attack?
That is not established. The wallet ties these releases to PolinRider activity, but no source here identifies who published them.
How do I know if my computer is infected?
Look for the .npm-ws files, the M260630A marker in npm's lib/cli.js, and the .inz leftover files, without running npm. If you find any, treat the machine as compromised.
The bigger lesson
Want your build pipeline to treat every new package as untrusted until it is checked? See our security hardening work or request a quote.
Get security alerts by email, with the free checklist, at our security alerts page.
Sources: Sonatype Research Labs; Sonatype record sonatype-2026-010515; Greenflagged; GitGuardian; OX Security; OSV MAL-2026-11986; npm registry.
Have a question about this article?
Ask it here and we will answer you directly by email. Questions are private, never posted.
Security alerts by email
Hear about the next one first.
When attackers start using a flaw in software businesses run on, we email what it is, whether it touches you and what to do that week, with a round-up of our latest security writing. Free, one-click unsubscribe. You get the checklist straight away: 12 things to secure this week.
Want a result like this?
Security alerts, breaches and the technology a business runs on: what happened, who it affects and what to do.
Get a Tech QuoteKeep reading
strutil-core Malware: Malicious Ruby Gem Steals Developer Credentials and Can Wipe Home Folders, and What to Check This Week
Version 1.0.1 of the Ruby gem strutil-core ran a credential-stealing worm during installation. Here is what So...
iPhone Exploit Kits: Leaked DarkSword Code Reached an Employee's iPhone Through an Instagram Ad, and How to Lock Down Work Phones
Criminals are now using leaked iPhone exploit kits built for spies to break into out-of-date iPhones through a...
iOS App Sandbox Bypass: Public worse_query Code Reaches Other Apps' Data on iOS 26 and 27.2, No Apple Fix Confirmed, and What to Do This Week
A developer has published worse_query, proof-of-concept code that lets an iPhone app reach other apps' data on...
