PolinRider DPRK npm Supply-Chain Loader Uses Blockchain Dead Drops for C2 (BeaverTail/InvisibleFerret)
PolinRider DPRK npm Supply-Chain Loader Uses Blockchain Dead (TL-2026-1215), also tracked as PolinRider, is a high-severity supply-chain compromise, first published 2026-07-11 and last reviewed 2026-08-04. It is attributed to Lazarus Group (North Korea) with high confidence, affects npm (deepthought26 publisher account) tailwind-color-shades, maps to 35 MITRE ATT&CK techniques (T1001, T1005, T1016), and is covered by 9 detection rules and 26 indicators of compromise.
Key facts for TL-2026-1215
- Threat ID
- TL-2026-1215
- Also known as
- PolinRider, A6-Shadow-15, A6-Shadow-14
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-07-11
- Last reviewed
- 2026-08-04
- Attribution
- Lazarus Group
- Attribution confidence
- HIGH
- Nation-state nexus
- North Korea
- Motivation
- FINANCIAL
- Target sectors
- technology, software development, cryptocurrency, finance
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 26
- Updates
- 2026-08-04
Malware and tooling in PolinRider DPRK npm Supply-Chain Loader Uses Blockchain Dead
Malware and tooling: BeaverTail - S1246, InvisibleFerret - S1245, PolinRider, AnyDesk
DPRK-attributed (Lazarus / Contagious Interview) supply-chain campaign PolinRider (A6-Shadow-15/A6-Shadow-14) trojanizes npm packages tailwind-color-shades 1.0.2 and safe-validate 1.0.4, published by account deepthought26. On import, the loader queries TRON and Aptos blockchains to locate payload addresses, decrypts an XOR-encoded payload from Binance Smart Chain burn-address transactions, then fetches a final stage over version-gated HTTP endpoints, delivering the BeaverTail stager followed by the InvisibleFerret RAT.
How PolinRider DPRK npm Supply-Chain Loader Uses Blockchain Dead works
PolinRider is a DPRK-attributed npm supply-chain loader first documented in a June 22, 2026 reverse-engineering writeup by researcher Melted in Hex, tracked internally under campaign markers A6-Shadow-15 (tailwind-color-shades 1.0.2) and A6-Shadow-14 (safe-validate 1.0.4). Both packages were published to the npm registry under the account deepthought26 and execute at import time rather than via install hooks: a single `import './src/bootstrap'` statement at the top of index.ts (or `require('./schema/bootstrap')` in the CommonJS variant) means the payload fires the moment a bundler or build tool resolves the module graph, and a `"sideEffects"` array in package.json (listing `./lib/bootstrap.js`) defeats tree-shaking that would otherwise strip the dead code.
The loader is wrapped in a multi-layer obfuscation stack: a custom character-shuffle decoder (dubbed the 'NVu' algorithm, using a seeded index permutation), Function-constructor-based eval (to avoid literal `eval` tokens that static scanners flag), obfuscator.io string-array rotation, and a final XOR layer over the fetched payload. A global marker variable (`global['_V'] = 'A6-Shadow-15'` or `'A6-Shadow-14'`) identifies the campaign/build to the operators.
The defining innovation is the C2 resolution mechanism: instead of a static domain or IP, the loader queries the TRON blockchain (primary resolver, e.g. account TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP) with an Aptos account as fallback (e.g. 0xbe0374...0811e). These accounts point to a Binance Smart Chain (BSC) transaction sent to a burn address (0x...dEaD), making the payload transaction immutable, unspendable, and effectively un-sinkholable and un-seizable by defenders or registrars. The transaction data is decrypted with a per-campaign XOR key (e.g. `2[gWfGj;<:-93Z^C` for the primary resolver, `m6:tTh^D)cBz?NM]` for the secondary) to yield the address of the next-stage HTTP endpoint. A third 'rotation pointer' account (TRON TA48dct6rFW8BXsiLAtjFaVFoSuryMjD3v / Aptos 0x533b2d...83e0b1) allows operators to rotate infrastructure without republishing the npm package, since the on-chain pointer — not the npm artifact — is what changes.
Once resolved, the loader issues `GET http://<c2-ip>/$/boot` with a custom `Sec-V` HTTP header carrying the campaign/version marker (e.g. `A6-Shadow-15`). Observed C2 hosts are 166.88.54.158 (ports 80/443, serving the 'A6-Shadow-15' cohort), 198.105.127.210 (ports 80/443, a numeric-marker cohort), and 23.27.202.27 (ports 443/27017, the default cohort). The HTTP response body is itself XOR-encrypted with a further key (`ThZG+0jfXE6VAGOJ`) before being decoded into the next stage.
The delivered payload chain begins with BeaverTail (MITRE ATT&CK S1246), a JavaScript/C++ credential-stealing loader used by DPRK's Contagious Interview cluster (G1052, aka DeceptiveDevelopment, Gwisin Gang, Tenacious Pungsan, DEV#POPPER, PurpleBravo, TAG-121) since 2022. BeaverTail fingerprints the host OS, harvests browser-stored credentials and cryptocurrency wallet data (MetaMask, Phantom, Binance, Coinbase, Solana), and downloads a bundled Python runtime ('p.zip') to launch InvisibleFerret (MITRE ATT&CK S1245), a modular Python RAT with main, payload, browser, and AnyDesk modules providing keylogging, clipboard capture, SSH key theft, environment-variable harvesting (AWS/GCP/npm/GitHub tokens), and remote access via bundled AnyDesk. A cleanup routine force-pushes the compromised developer's git repositories while preserving original commit timestamps to hide evidence of tampering.
This PolinRider variant is part of the broader, long-running DPRK 'Contagious Interview' supply-chain operation that has repeatedly trojanized npm packages (e.g. postcss-optimizer/yolorabbit in a related 2026 incident) to target software developers and cryptocurrency professionals, with the blockchain dead-drop mechanism representing a novel evolution intended to defeat conventional C2 sinkholing and domain/IP takedown actions.
MITRE ATT&CK techniques used in TL-2026-1215
command-and-control
Collection
T1005 Data from Local System; T1074 Data Staged; T1115 Clipboard Data; T1560 Archive Collected Data
Discovery
T1016 System Network Configuration Discovery; T1033 System Owner/User Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1217 Browser Information Discovery; T1518 Software Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1564 Hide Artifacts
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Credential Access
T1056 Input Capture; T1555 Credentials from Password Stores
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer; T1219 Remote Access Tools; T1571 Non-Standard Port; T1573 Encrypted Channel
Initial Access
T1195 Supply Chain Compromise; T1566 Phishing
Persistence
T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution
stealth
Impact
Affected products and versions in PolinRider DPRK npm Supply-Chain Loader Uses Blockchain Dead
- npm (deepthought26 publisher account) — tailwind-color-shades
Vulnerable versions: 1.0.2 - npm (deepthought26 publisher account) — safe-validate
Vulnerable versions: 1.0.4
Remediation for PolinRider DPRK npm Supply-Chain Loader Uses Blockchain Dead
Immediate actions
- Block/remove npm packages tailwind-color-shades 1.0.2 and safe-validate 1.0.4 from developer environments and internal registry mirrors
- Block outbound connections to C2 IPs 166.88.54.158, 198.105.127.210, and 23.27.202.27
- Alert on HTTP requests to path '/$/boot' or containing a 'Sec-V' request header
- Suspend/report the npm publisher account deepthought26
- Rotate credentials and cryptocurrency wallet keys on any developer workstation that installed the affected packages
- Audit git repositories for force-pushes with preserved-but-suspicious commit timestamps
Workarounds
- Pin dependency versions and use a private npm proxy/registry that vets new package versions before promotion
Longer-term hardening
- Deploy software composition analysis (SCA) / npm supply-chain scanning in CI that flags import-time side effects and sideEffects package.json overrides
- Monitor build-time network egress from CI/CD and developer machines to blockchain RPC endpoints (trongrid.io, aptoslabs.com, bsc-dataseed.binance.org) as a detection signal, not a blanket block
- Enforce npm package allowlisting / lockfile integrity verification and provenance attestation (npm provenance, Sigstore)
- Deploy EDR with behavioral detection for Python-based RATs and AnyDesk abuse
- Train developers on Contagious Interview social-engineering lures (fake job interviews, coding challenges)
Weaknesses (CWE) in PolinRider DPRK npm Supply-Chain Loader Uses Blockchain Dead
CWE-506, CWE-829, CWE-494
Timeline of PolinRider DPRK npm Supply-Chain Loader Uses Blockchain Dead
- BeaverTail malware first observed in use by DPRK-linked Contagious Interview cluster.
- InvisibleFerret Python RAT first documented as second-stage payload deployed by Contagious Interview.
- OpenSourceMalware research team initially identifies the broader PolinRider campaign, finding obfuscated JavaScript loaders delivering BeaverTail variants across hundreds of public GitHub repositories.
- Microsoft publishes threat intelligence on Contagious Interview fake job interview malware campaigns.
- PolinRider campaign tracked as having compromised 1,951 public GitHub repositories across 1,047 unique repository owners; npm publisher accounts allavin and blackedward deleted/scrubbed from the registry around this time.
- Source repository deepthought26/schema-checker (backing the safe-validate npm package) created; clean versions 1.0.1-1.0.3 of safe-validate published to npm the same day.
- Weaponized safe-validate 1.0.4 published with the tree-shaking-defeating 'sideEffects' package.json flag targeting bootstrap.js; tailwind-color-shades republished the same day, indicating coordinated multi-package campaign expansion under the deepthought26 account.
- Researcher Melted in Hex publishes 'Dead Drops on the Blockchain' reverse-engineering writeup and discloses findings on X/Twitter same day; entry added to Malpedia.
- Malicious npm packages tailwind-color-shades 1.0.2 and safe-validate 1.0.4 flagged on npm under account deepthought26, detected by scanner monitoring recent-publish feeds.
- Archived snapshot of the disclosure blog post created via Wayback Machine.
- The Hacker News reports the expanded PolinRider campaign has published 108 unique malicious packages/extensions (162 release artifacts total: 19 npm libraries, 10 Composer packages, 61 Go modules, and one Chrome extension) across npm, Packagist, Go, and Chrome platforms.
- OpenSourceMalware publishes 'PolinRider Rides Again' follow-up documenting campaign expansion beyond npm into Packagist, Go Modules, and a Chrome extension.
- Threadlinqs Intelligence completes deep-dive research and MITRE ATT&CK mapping of the PolinRider campaign.
Update history for TL-2026-1215
- 2026-08-04 — tweetfeed.live community intel: New TL_OSINT_Scan community intel: 1 newly-corroborated indicator(s), 113 community-related indicator(s).
Sources cited for PolinRider DPRK npm Supply-Chain Loader Uses Blockchain Dead
- Dead Drops on the Blockchain: Reversing a DPRK npm Loader (PolinRider / A6-Shadow-15)
- Dead Drops on the Blockchain (archived)
- PolinRider - Malpedia
- InvisibleFerret, Software S1245 | MITRE ATT&CK
- BeaverTail, Software S1246 | MITRE ATT&CK
- Contagious Interview, Group G1052 | MITRE ATT&CK
- Contagious Interview: Malware delivered through fake developer job interviews
- North Korean APT Lazarus Targets Developers with Malicious npm Package
- North Korean APTs Target Node.js Ecosystem: BeaverTail-OtterCookie JavaScript Malware Exploits npm Supply Chain
- InvisibleFerret Malware Attacking Windows Users Through Fake Job Interview Tactics
- PolinRider: DPRK Threat Actor That Compromised Hundreds of GitHub Repos Is Unmasked
- PolinRider Rides Again: North Korean Attack Expands Across GitHub
- North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign
- Active Exploitation Alert: North Korean PolinRider Supply Chain Attack Targets npm, Packagist, Go Modules, and Chrome Extensions
- OpenSourceMalware/PolinRider technical dossier
Threats related to PolinRider DPRK npm Supply-Chain Loader Uses Blockchain Dead
- Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan
- ViteVenom: Blockchain-C2 npm Supply Chain Malware Targets Vite Ecosystem (Sequel to ChainVeil, PolinRider Cluster)
- Joyfill npm Supply-Chain Compromise: @joyfill/components and @joyfill/layouts Ship Obfuscated Worm-Like RAT and Credential Stealer
- Lazarus-Linked npm Malware Masquerades as Rollup Polyfills (rollup-packages-polyfill-core, rollup-runtime-polyfill-core, swift-parse-stream, quirky-token, rollup-plugin-polyfill-connect, react-icon-svgs)
- ViteVenom Campaign: Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver RAT
- astro.config.mjs Supply Chain Attack via Blockchain Dead-Drop C2 (PolinRider / js.jadesnow)
Detection coverage for TL-2026-1215
As of 2026-08-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1215 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1215
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.