Threat reportSupply ChainTL-2026-0846
astro.config.mjs Supply Chain Attack via Blockchain Dead-Drop C2 (PolinRider / js.jadesnow)
astro.config.mjs Supply Chain Attack via Blockchain (TL-2026-0846), also tracked as PolinRider, is a high-severity supply-chain compromise, first published 2026-06-18 and last reviewed 2026-08-04. It is attributed to PolinRider (North Korea) with high confidence, affects Egonex-AI Understand-Anything, maps to 19 MITRE ATT&CK techniques (T1008, T1027, T1036), and is covered by 9 detection rules and 27 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 19MITRE ATT&CK
- Actors
- 1PolinRider
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 27Indicators of compromise
Key facts for TL-2026-0846
- Threat ID
- TL-2026-0846
- Also known as
- PolinRider, js.jadesnow, JADESNOW astro.config.mjs supply-chain variant
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution
- PolinRider
- Attribution confidence
- HIGH
- Nation-state nexus
- North Korea
- Motivation
- FINANCIAL
- Target sectors
- technology, software development, open source, cryptocurrency, developer tooling
- Target regions
- Global, North America, Europe, Asia
- Detection rules
- 9
- Indicators of compromise
- 27
- Updates
- 2026-08-04
Malware and tooling in astro.config.mjs Supply Chain Attack via Blockchain
Malware and tooling: JADESNOW
How astro.config.mjs Supply Chain Attack via Blockchain works
DPRK-linked actor PolinRider attempted to poison the Egonex-AI/Understand-Anything repository (57,000+ GitHub stars) by submitting three malicious pull requests (#198, #206, #261) that injected obfuscated JavaScript into homepage/astro.config.mjs. Astro automatically evaluates this config on every build/dev/preview, executing a two-stage loader that resolves commands from a Tron/BSC/Aptos blockchain dead drop, making the C2 resilient to IP and DNS takedown.
In late May 2026 a GitHub account named AsimRaza10 opened three pull requests (#198, #206, #261) against Egonex-AI/Understand-Anything, a popular (57,000+ star) code-to-knowledge-graph tool. All three PRs carried cover stories that did not match their diffs (a README edit, a React 'Path Finder' reachability fix referencing useEffect/useMemo files that were never touched, and a community-health chore) yet every one modified only .gitignore and homepage/astro.config.mjs and resolved to the same commit 8d30be36. The malicious code was hidden behind hundreds of characters of horizontal whitespace on a single line so it rendered past GitHub's visible diff area, and the .gitignore additions concealed Windows propagation helpers (branch_structure.json, temp_auto_push.bat, temp_interactive_push.bat).
Because Astro evaluates astro.config.mjs as a Node.js module before any user code on every `astro build`, `astro dev`, and `astro preview`, the payload executes with full filesystem and environment access in developer and CI/CD contexts. The injected, heavily obfuscated IIFE (string-shuffle cipher via the _$_1e42 decoder, shuffle marker rmcej%otb%, layer-1 seed 2857687) reconstructs require() in the ESM context using createRequire(import.meta.url) and runs a two-stage loader.
Stage B ('boot') selects a hard-coded HTTP C2 based on a campaign marker stored in global._V, beacons the /$/boot endpoint with a spoofed Chrome 131 User-Agent, XOR-decrypts the response with key 'ThZG+0jfXE6VAGOJ', and eval()s the downloaded bot, exfiltrating the campaign marker in a 'Sec-V' header. Stage A ('resolver') implements a blockchain dead-drop: it reads the latest outgoing transaction from a Tron address, extracts and reverses the raw_data.data hex to obtain a BSC transaction hash (falling back to an Aptos account payload), fetches that BSC transaction via eth_getTransactionByHash, hex-decodes tx.input, splits on the delimiter '?.?', and XOR-decrypts the right segment with key '2[gWfGj;<:-93Z^C' before eval()ing the resulting JavaScript command. Because only public RPC nodes are contacted and commands live in immutable blockchain transactions, the operator can rotate the next-stage payload without touching the repository and the channel resists DNS/IP blocklisting.
SafeDep attributes the operation to the DPRK-linked PolinRider campaign (Malpedia family js.jadesnow), citing matching cryptographic fingerprints: the _$_1e42 decoder, the un-rotated rmcej%otb% shuffle marker, layer-1 seed 2857687, the identical Tron dead-drop address, the identical chain XOR key, and the temp_auto_push.bat propagation artifact. The js.jadesnow/JADESNOW lineage overlaps with GTIG's UNC5342 'Contagious Interview' EtherHiding activity that uses JADESNOW to stage a JavaScript InvisibleFerret variant for cryptocurrency theft. This is the first documented instance of PolinRider targeting an upstream repository's PR workflow rather than directly infecting individual developers; the variant uses the original (v1) obfuscation predating the April 2026 rotation, suggesting lagging tooling or a parallel operator. All three PRs were identified during static review and disclosed publicly via GitHub issue #432 on 2026-06-12.
MITRE ATT&CK techniques used in TL-2026-0846
Command and Control
T1008 Fallback Channels; T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer; T1132 Data Encoding; T1573 Encrypted Channel
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059 Command and Scripting Interpreter
Initial Access
T1195 Supply Chain Compromise; T1199 Trusted Relationship
Persistence
T1505 Server Software Component
Credential Access
T1555 Credentials from Password Stores
Resource Development
T1585 Establish Accounts; T1587 Develop Capabilities; T1608 Stage Capabilities
Impact
Affected products and versions in astro.config.mjs Supply Chain Attack via Blockchain
- Egonex-AI — Understand-Anything
Vulnerable versions: branches built from PRs #198/#206/#261 (commit 8d30be36)
Fixed in: main branch with the three malicious PRs closed/unmerged - Astro — Astro framework (build tooling)
Vulnerable versions: any version — astro.config.mjs is auto-evaluated on build/dev/preview
Remediation for astro.config.mjs Supply Chain Attack via Blockchain
Patches
- No vendor patch — this is a source-integrity issue. Ensure the three malicious PRs remain closed/unmerged and the poisoned commit 8d30be36 is purged from any local clones.
Immediate actions
- If any of PRs #198/#206/#261 (commit 8d30be36) were checked out and built locally or in CI, treat the build environment as fully compromised.
- Rotate ALL credentials exposed to the build environment: npm/registry tokens, cloud keys, CI/CD secrets, and any access tokens visible to the process.
- Block the C2 IPs 166.88.54.158, 198.105.127.210, and 23.27.202.27:27017 at the perimeter and review outbound logs for connections to them and to the /$/boot path.
- Audit blockchain RPC egress from build/CI hosts for queries to the Tron address TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP, the listed BSC transactions, and the Aptos fallback account.
Workarounds
- Build untrusted branches only in ephemeral, network-restricted sandboxes with no standing secrets.
- Pin and review astro.config.mjs; treat any createRequire(import.meta.url) in an ESM config as malicious.
Longer-term hardening
- Forbid PR merges whose described changes do not match the actual diff; require human review of any change to build-config files (*.config.mjs/.cjs/.ts).
- Run a CI lint that rejects createRequire / eval / dynamic network calls inside Astro/Vite/PostCSS/Tailwind config files.
- Render diffs with whitespace/long-line warnings so payloads cannot hide past the visible area.
- Deploy EDR with behavioral detection of Node build processes making outbound HTTP or public blockchain RPC calls.
Weaknesses (CWE) in astro.config.mjs Supply Chain Attack via Blockchain
Timeline of astro.config.mjs Supply Chain Attack via Blockchain
- GTIG documents DPRK actor UNC5342 using JADESNOW + EtherHiding to stage a JavaScript InvisibleFerret variant from BSC/Ethereum smart contracts in the Contagious Interview campaign — the js.jadesnow lineage behind this variant.
- The Hacker News reports on the GTIG findings, publicizing North Korean use of EtherHiding to conceal malware inside blockchain smart contracts — the technique the astro.config.mjs variant later operationalizes via a Tron/BSC dead drop.
- OpenSourceMalware unmasks the PolinRider campaign, reporting 675 compromised repositories across 352 owners via obfuscated JS appended to config files (postcss.config.mjs, tailwind.config.js) with blockchain C2.
- PolinRider obfuscation rotates (v2); scale grows to 1,951 compromised repositories / 1,047 owners. The astro.config.mjs variant later uses the older v1 markers, predating this rotation.
- GitHub account AsimRaza10 opens malicious pull requests #198 (README cover story) and #206 (fake React Path Finder fix referencing useEffect/useMemo files never touched) against Egonex-AI/Understand-Anything; both resolve to commit 8d30be36.
- AsimRaza10 opens a third malicious PR #261 (community-health chore cover story), again modifying only .gitignore and astro.config.mjs and resolving to commit 8d30be36.
- Attack publicly disclosed via GitHub issue #432; all three malicious PRs remain unmerged/closed.
- SafeDep attributes the operation to the DPRK-linked PolinRider campaign (Malpedia family js.jadesnow) on matching cryptographic fingerprints: the _$_1e42 decoder, the un-rotated rmcej%otb% shuffle marker, layer-1 seed 2857687, the shared Tron dead-drop address, the chain XOR key, and the temp_auto_push.bat artifact.
- Static code review identifies the obfuscated payload hidden behind hundreds of characters of horizontal whitespace in PR #206; SafeDep publishes full analysis and Malpedia catalogs the js.jadesnow family.
Update history for TL-2026-0846
- 2026-08-04 — tweetfeed.live community intel: New TL_OSINT_Scan community intel: 1 newly-corroborated indicator(s), 60 community-related indicator(s).
Sources cited for astro.config.mjs Supply Chain Attack via Blockchain
- astro.config.mjs Supply Chain Attack via Blockchain C2
- Malpedia library entry: js.jadesnow (astro.config.mjs Supply Chain Attack via Blockchain C2)
- PolinRider Campaign: DPRK-Linked Supply Chain Attack Infects GitHub Repositories
- PolinRider Rides Again: North Korean Attack Expands Across GitHub
- PolinRider: DPRK Threat Actor That Compromised Hundreds of GitHub Repos Is Unmasked
- PolinRider Campaign (Wiz Threats)
- OpenSourceMalware/PolinRider — technical dossier on the DPRK threat actor
- DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains (JADESNOW / UNC5342)
- North Korean Hackers Use EtherHiding to Hide Malware Inside Blockchain Smart Contracts
Detection coverage for TL-2026-0846
As of 2026-08-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0846 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.