astro.config.mjs Supply Chain Attack via Blockchain Dead-Drop C2 (PolinRider / js.jadesnow)

astro.config.mjs Supply Chain Attack via Blockchain (TL-2026-0846), also tracked as PolinRider, is a high-severity supply-chain compromise, first published 2026-06-18 and last reviewed 2026-08-04. It is attributed to PolinRider (North Korea) with high confidence, affects Egonex-AI Understand-Anything, maps to 19 MITRE ATT&CK techniques (T1008, T1027, T1036), and is covered by 9 detection rules and 27 indicators of compromise.

Key facts for TL-2026-0846

Threat ID
TL-2026-0846
Also known as
PolinRider, js.jadesnow, JADESNOW astro.config.mjs supply-chain variant
Severity
HIGH
Status
ACTIVE
Category
SUPPLY_CHAIN
First published
2026-06-18
Last reviewed
2026-08-04
Attribution
PolinRider
Attribution confidence
HIGH
Nation-state nexus
North Korea
Motivation
FINANCIAL
Target sectors
technology, software development, open source, cryptocurrency, developer tooling
Target regions
Global, North America, Europe, Asia
Detection rules
9
Indicators of compromise
27
Updates
2026-08-04

Malware and tooling in astro.config.mjs Supply Chain Attack via Blockchain

Malware and tooling: JADESNOW

DPRK-linked actor PolinRider attempted to poison the Egonex-AI/Understand-Anything repository (57,000+ GitHub stars) by submitting three malicious pull requests (#198, #206, #261) that injected obfuscated JavaScript into homepage/astro.config.mjs. Astro automatically evaluates this config on every build/dev/preview, executing a two-stage loader that resolves commands from a Tron/BSC/Aptos blockchain dead drop, making the C2 resilient to IP and DNS takedown.

How astro.config.mjs Supply Chain Attack via Blockchain works

In late May 2026 a GitHub account named AsimRaza10 opened three pull requests (#198, #206, #261) against Egonex-AI/Understand-Anything, a popular (57,000+ star) code-to-knowledge-graph tool. All three PRs carried cover stories that did not match their diffs (a README edit, a React 'Path Finder' reachability fix referencing useEffect/useMemo files that were never touched, and a community-health chore) yet every one modified only .gitignore and homepage/astro.config.mjs and resolved to the same commit 8d30be36. The malicious code was hidden behind hundreds of characters of horizontal whitespace on a single line so it rendered past GitHub's visible diff area, and the .gitignore additions concealed Windows propagation helpers (branch_structure.json, temp_auto_push.bat, temp_interactive_push.bat).

Because Astro evaluates astro.config.mjs as a Node.js module before any user code on every `astro build`, `astro dev`, and `astro preview`, the payload executes with full filesystem and environment access in developer and CI/CD contexts. The injected, heavily obfuscated IIFE (string-shuffle cipher via the _$_1e42 decoder, shuffle marker rmcej%otb%, layer-1 seed 2857687) reconstructs require() in the ESM context using createRequire(import.meta.url) and runs a two-stage loader.

Stage B ('boot') selects a hard-coded HTTP C2 based on a campaign marker stored in global._V, beacons the /$/boot endpoint with a spoofed Chrome 131 User-Agent, XOR-decrypts the response with key 'ThZG+0jfXE6VAGOJ', and eval()s the downloaded bot, exfiltrating the campaign marker in a 'Sec-V' header. Stage A ('resolver') implements a blockchain dead-drop: it reads the latest outgoing transaction from a Tron address, extracts and reverses the raw_data.data hex to obtain a BSC transaction hash (falling back to an Aptos account payload), fetches that BSC transaction via eth_getTransactionByHash, hex-decodes tx.input, splits on the delimiter '?.?', and XOR-decrypts the right segment with key '2[gWfGj;<:-93Z^C' before eval()ing the resulting JavaScript command. Because only public RPC nodes are contacted and commands live in immutable blockchain transactions, the operator can rotate the next-stage payload without touching the repository and the channel resists DNS/IP blocklisting.

SafeDep attributes the operation to the DPRK-linked PolinRider campaign (Malpedia family js.jadesnow), citing matching cryptographic fingerprints: the _$_1e42 decoder, the un-rotated rmcej%otb% shuffle marker, layer-1 seed 2857687, the identical Tron dead-drop address, the identical chain XOR key, and the temp_auto_push.bat propagation artifact. The js.jadesnow/JADESNOW lineage overlaps with GTIG's UNC5342 'Contagious Interview' EtherHiding activity that uses JADESNOW to stage a JavaScript InvisibleFerret variant for cryptocurrency theft. This is the first documented instance of PolinRider targeting an upstream repository's PR workflow rather than directly infecting individual developers; the variant uses the original (v1) obfuscation predating the April 2026 rotation, suggesting lagging tooling or a parallel operator. All three PRs were identified during static review and disclosed publicly via GitHub issue #432 on 2026-06-12.

MITRE ATT&CK techniques used in TL-2026-0846

Command and Control

T1008 Fallback Channels; T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer; T1132 Data Encoding; T1573 Encrypted Channel

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059 Command and Scripting Interpreter

Initial Access

T1195 Supply Chain Compromise; T1199 Trusted Relationship

Persistence

T1505 Server Software Component

Credential Access

T1555 Credentials from Password Stores

Resource Development

T1585 Establish Accounts; T1587 Develop Capabilities; T1608 Stage Capabilities

Impact

T1657 Financial Theft

Affected products and versions in astro.config.mjs Supply Chain Attack via Blockchain

  • Egonex-AI — Understand-Anything
    Vulnerable versions: branches built from PRs #198/#206/#261 (commit 8d30be36)
    Fixed in: main branch with the three malicious PRs closed/unmerged
  • Astro — Astro framework (build tooling)
    Vulnerable versions: any version — astro.config.mjs is auto-evaluated on build/dev/preview

Remediation for astro.config.mjs Supply Chain Attack via Blockchain

Patches

  • No vendor patch — this is a source-integrity issue. Ensure the three malicious PRs remain closed/unmerged and the poisoned commit 8d30be36 is purged from any local clones.

Immediate actions

  • If any of PRs #198/#206/#261 (commit 8d30be36) were checked out and built locally or in CI, treat the build environment as fully compromised.
  • Rotate ALL credentials exposed to the build environment: npm/registry tokens, cloud keys, CI/CD secrets, and any access tokens visible to the process.
  • Block the C2 IPs 166.88.54.158, 198.105.127.210, and 23.27.202.27:27017 at the perimeter and review outbound logs for connections to them and to the /$/boot path.
  • Audit blockchain RPC egress from build/CI hosts for queries to the Tron address TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP, the listed BSC transactions, and the Aptos fallback account.

Workarounds

  • Build untrusted branches only in ephemeral, network-restricted sandboxes with no standing secrets.
  • Pin and review astro.config.mjs; treat any createRequire(import.meta.url) in an ESM config as malicious.

Longer-term hardening

  • Forbid PR merges whose described changes do not match the actual diff; require human review of any change to build-config files (*.config.mjs/.cjs/.ts).
  • Run a CI lint that rejects createRequire / eval / dynamic network calls inside Astro/Vite/PostCSS/Tailwind config files.
  • Render diffs with whitespace/long-line warnings so payloads cannot hide past the visible area.
  • Deploy EDR with behavioral detection of Node build processes making outbound HTTP or public blockchain RPC calls.

Weaknesses (CWE) in astro.config.mjs Supply Chain Attack via Blockchain

CWE-506, CWE-829, CWE-1357, CWE-94

Timeline of astro.config.mjs Supply Chain Attack via Blockchain

  • GTIG documents DPRK actor UNC5342 using JADESNOW + EtherHiding to stage a JavaScript InvisibleFerret variant from BSC/Ethereum smart contracts in the Contagious Interview campaign — the js.jadesnow lineage behind this variant.
  • The Hacker News reports on the GTIG findings, publicizing North Korean use of EtherHiding to conceal malware inside blockchain smart contracts — the technique the astro.config.mjs variant later operationalizes via a Tron/BSC dead drop.
  • OpenSourceMalware unmasks the PolinRider campaign, reporting 675 compromised repositories across 352 owners via obfuscated JS appended to config files (postcss.config.mjs, tailwind.config.js) with blockchain C2.
  • PolinRider obfuscation rotates (v2); scale grows to 1,951 compromised repositories / 1,047 owners. The astro.config.mjs variant later uses the older v1 markers, predating this rotation.
  • GitHub account AsimRaza10 opens malicious pull requests #198 (README cover story) and #206 (fake React Path Finder fix referencing useEffect/useMemo files never touched) against Egonex-AI/Understand-Anything; both resolve to commit 8d30be36.
  • AsimRaza10 opens a third malicious PR #261 (community-health chore cover story), again modifying only .gitignore and astro.config.mjs and resolving to commit 8d30be36.
  • Attack publicly disclosed via GitHub issue #432; all three malicious PRs remain unmerged/closed.
  • SafeDep attributes the operation to the DPRK-linked PolinRider campaign (Malpedia family js.jadesnow) on matching cryptographic fingerprints: the _$_1e42 decoder, the un-rotated rmcej%otb% shuffle marker, layer-1 seed 2857687, the shared Tron dead-drop address, the chain XOR key, and the temp_auto_push.bat artifact.
  • Static code review identifies the obfuscated payload hidden behind hundreds of characters of horizontal whitespace in PR #206; SafeDep publishes full analysis and Malpedia catalogs the js.jadesnow family.

Update history for TL-2026-0846

  • 2026-08-04 — tweetfeed.live community intel: New TL_OSINT_Scan community intel: 1 newly-corroborated indicator(s), 60 community-related indicator(s).

Sources cited for astro.config.mjs Supply Chain Attack via Blockchain

Threats related to astro.config.mjs Supply Chain Attack via Blockchain

Detection coverage for TL-2026-0846

As of 2026-08-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0846 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats