PolinRider npm Malware: 12 Hijacked Releases Use Ethereum to Find Their Server, and How to Check Your Builds

Attackers hijacked 10 npm packages and published 12 poisoned releases that run hidden code as soon as an application loads them. If a developer laptop or build server pulled one of those releases, it may have given an outsider a way in, and deleting the package does not undo that.

npm is the public registry JavaScript projects download their building blocks from, so this matters to any business whose website or app is built with those tools. The releases have been removed, but machines that already ran them, and caches that still hold them, remain a problem.

What happened in the PolinRider npm attack

Greenflagged, a firm that scans package registries, published timestamps showing the first poisoned release went live at 22:00 UTC on November 3, 2026, and the last at 07:28 UTC on November 4. It reports npm had removed all 12 by about 20:40 UTC on November 4. Sonatype investigated on November 4, confirmed the 12 releases, and tracks the event as sonatype-2026-010515.

Sonatype links the releases to PolinRider, a campaign previously seen hiding loaders in compromised GitHub repositories. That link rests on technical overlaps: the same Ethereum wallet, the same server infrastructure and the same download paths.

Which npm packages were hijacked

OX Security's table adds seven more entries, which Sonatype's list does not include: react-contact-forms 0.5.2, tailwindcss-form-utils 0.5.9, tailwind-contact-forms 0.5.8, tailwindcss-contact-form 0.5.5, tailwind-form-core 0.5.5, tailwind-input-kit 0.5.5 and tailwind-forms-kit 0.5.5. Check for those as well.

What is confirmed and what is not

Confirmed by more than one research team:

• The 12 releases above appear in the Sonatype, Greenflagged and OX Security reports.
• The malicious code runs when the package is loaded. There is no install script.
• The loaders read Ethereum wallet 0x1eef0849eda15d87f64e51c73c8442cf3c8bcef3, which GitGuardian had already listed on October 27 as part of PolinRider activity in GitHub repositories.

Reported by one team:

• Greenflagged says it retrieved the later stages from the attackers' server and found a remote-access tool that can run shell commands, upload files and read the clipboard. It says the tool persists by altering npm's own lib/cli.js and startup files for VS Code, Cursor, Antigravity, Discord and GitHub Desktop. Most of that analysis was static, meaning the code was read rather than run.
• OX Security estimates about 1,400 combined weekly downloads for the packages it lists, and notes that figure is not confirmed infections.

Not known:

• How the publishing accounts were hijacked. Greenflagged saw the publisher change to clockbook-app on November 3, with a second account, pubngo-stack, publishing on November 4. No source explains how.
• How many machines ran the code. No victim count has been published.
• Who ran this wave. Sonatype's write-up, Greenflagged and OX Security name no actor for these releases. OpenSourceMalware attributed the wider PolinRider campaign to North Korea in March 2026, and GitGuardian's October report says only that the campaign "was originally attributed to the DPRK threat actor." That is earlier attribution of the wider campaign, not a finding about this npm incident.

How PolinRider uses Ethereum for command and control

The loader carries no fixed server address. It reads the latest transaction sent from the hard-coded wallet, using public Ethereum services with Blockscout as a backup, and converts the transaction's recipient address into server IP addresses. It then downloads encoded JavaScript over plain HTTP on TCP port 443 from the paths /0x/cls and /0x/ls.

Ethereum only stores the pointer. The malware itself sits on an ordinary server. Because the operator can publish a new address with one transaction, blocking a single server does not stop the loader from finding the next one, and no new npm release is needed. Greenflagged recorded four addresses so far: 166.88.134.75, 103.179.143.219, 23.27.13.72 and, most recently, 95.135.181.151. As of its November 4 update, it said the wallet was still live.

Why this matters for a company network or website

Developer laptops and build servers hold the keys to everything else. Sonatype's advice names what is at stake: publishing credentials, source code access, cloud keys and CI secrets.

This is not limited to laptops either. In server-hemera-mongo the injected code sits in dist/main.js, which runs when the application starts, so a production server using that release would run it too. And GitGuardian documented a stealer aimed at browser logins, cookies and about 150 password manager and crypto wallet extensions in the PolinRider chain it studied on GitHub. Greenflagged did not report credential theft in what it retrieved from the npm chain, but if the code ran on your machine, plan as though credentials were exposed.

What to do this week

PolinRider malware questions people are asking

What is PolinRider malware?

PolinRider is a campaign that hides loaders in code developers trust, first in compromised GitHub repositories and now in hijacked npm packages. The loaders fetch further code from attacker servers.

Does disabling npm install scripts stop it?

No. These releases have no install hooks. The code runs when the module is loaded or the application starts.

Is removing the malicious npm package enough?

No. Greenflagged says removal does not undo anything on a machine that already ran the second stage. Those machines need investigation.

Is there a fixed version to install?

No source names one, and OX Security's fix column is blank. Sonatype advises using independently verified replacements.

If the package failed to load, am I safe?

Not necessarily. Greenflagged tested a harmless copy and found the loader errors out in four of the five packages published on November 4, because they are ES modules. Sonatype warns an import error does not prove the code did not run, so check anyway.

Is PolinRider from North Korea?

Earlier research attributed the wider campaign to North Korea. None of the three primary reports on these npm releases names an actor.

The bigger lesson

The package names your team trusted did not change. Only the account publishing them did, and nothing in a normal install would have flagged it. The practical test is whether your business can answer one question quickly: did this code run on any machine we own, and what could that machine reach?

We can help you get that answer through security hardening, or you can request a quote.

Get security alerts by email, with the free checklist, at our security alerts page.

Sources: Sonatype; Greenflagged; OX Security; GitGuardian; OpenSourceMalware.