PolinRider DPRK npm Supply-Chain Loader Uses Blockchain Dead Drops for C2 (BeaverTail/InvisibleFerret) — Threadlinqs Intelligence
As of 2026-07-11, PolinRider DPRK npm Supply-Chain Loader Uses Blockchain Dead Drops for C2 (BeaverTail/InvisibleFerret) is a high-severity supply chain threat attributed to Lazarus Group (North Korea (DPRK)), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 26 indicators of compromise.
Threat ID: TL-2026-1215 · Severity: HIGH · Status: ACTIVE · Category: SUPPLY_CHAIN
Attribution: Lazarus Group · North Korea (DPRK) · FINANCIAL
DPRK-attributed (Lazarus / Contagious Interview) supply-chain campaign PolinRider (A6-Shadow-15/A6-Shadow-14) trojanizes npm packages tailwind-color-shades 1.0.2 and safe-validate 1.0.4, published by
PolinRider is a DPRK-attributed npm supply-chain loader first documented in a June 22, 2026 reverse-engineering writeup by researcher Melted in Hex, tracked internally under campaign markers A6-Shadow-15 (tailwind-color-shades 1.0.2) and A6-Shadow-14 (safe-validate 1.0.4). Both packages were published to the npm registry under the account deepthought26 and execute at import time rather than via install hooks: a single `import './src/bootstrap'` statement at the top of index.ts (or `require('./schema/bootstrap')` in the CommonJS variant) means the payload fires the moment a bundler or build tool resolves the module graph, and a `"sideEffects"` array in package.json (listing `./lib/bootstrap.js`) defeats tree-shaking that would otherwise strip the dead code.
The loader is wrapped in a multi-layer obfuscation stack: a custom character-shuffle decoder (dubbed the 'NVu' algorithm, using a seeded index permutation), Function-constructor-based eval (to avoid literal `eval` tokens that static scanners flag), obfuscator.io string-array rotation, and a final XOR layer over the fetched payload. A global marker variable (`global['_V'] = 'A6-Shadow-15'` or `'A6-Shadow-14'`) identifies the campaign/build to the operators.
The defining innovation is the C2 resolution mechanism: instead of a static domain or IP, the loader queries the TRON blockchain (primary resolver, e.g. account TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP) with an Aptos account as fallback (e.g. 0xbe0374...0811e). These accounts point to a Binance Smart Chain (BSC) transaction sent to a burn address (0x...dEaD), making the payload transaction immutable, unspendable, and effectively un-sinkholable and un-seizable by defenders or registrars. The transaction data is decrypted with a per-campaign XOR key (e.g. `2[gWfGj;<:-93Z^C` for the primary resolver, `m6:tTh^D)cBz?NM]` for the secondary) to yield the address of the next-stage HTTP endpoint. A third 'rotation pointer' account (TRON TA48dct6rFW8BXsiLAtjFaVFoSuryMjD3v / Aptos 0x533b2d...83e0b1) allows operators to rotate infrastructure without republishing the npm package, since the on-chain pointer — not the npm artifact — is what changes.
Once resolved, the loader issues `GET http://<c2-ip>/$/boot` with a custom `Sec-V` HTTP header carrying the campaign/version marker (e.g. `A6-Shadow-15`). Observed C2 hosts are 166.88.54.158 (ports 80/443, serving the 'A6-Shadow-15' cohort), 198.105.127.210 (ports 80/443, a numeric-marker cohort), and 23.27.202.27 (ports 443/27017, the default cohort). The HTTP response body is itself XOR-encrypted with a further key (`ThZG+0jfXE6VAGOJ`) before being decoded into the next stage.
The delivered payload chain begins with BeaverTail (MITRE ATT&CK S1246), a JavaScript/C++ credential-stealing loader used by DPRK's Contagious Interview cluster (G1052, aka DeceptiveDevelopment, Gwisin Gang, Tenacious Pungsan, DEV#POPPER, PurpleBravo, TAG-121) since 2022. BeaverTail fingerprints the host OS, harvests browser-stored credentials and cryptocurrency wallet data (MetaMask, Phantom, Binance, Coinbase, Solana), and downloads a bundled Python runtime ('p.zip') to launch InvisibleFerret (MITRE ATT&CK S1245), a modular Python RAT with main, payload, browser, and AnyDesk modules providing keylogging, clipboard capture, SSH key theft, environment-variable harvesting (AWS/GCP/npm/GitHub tokens), and remote access via bundled AnyDesk. A cleanup routine force-pushes the compromised developer's git repositories while preserving original commit timestamps to hide evidence of tampering.
This PolinRider variant is part of the broader, long-running DPRK 'Contagious Interview' supply-chain operation that has repeatedly trojanized npm packages (e.g. postcss-optimizer/yolorabbit in a related 2026 incident) to target software developers and cryptocurrency professionals, with the blockchain dead-drop mechanism representing a novel evolution intended to defeat conventional C2 sinkholing and domain/IP takedown actions.
Weaknesses (CWE)
CWE-506, CWE-829, CWE-494
Target sectors: technology, software development, cryptocurrency, finance
Target regions: Global
Related threats
- Lazarus-Linked npm Malware Masquerades as Rollup Polyfills (rollup-packages-polyfill-core, rollup-runtime-polyfill-core, swift-parse-stream, quirky-token, rollup-plugin-polyfill-connect, react-icon-svgs)
- PolinRider DPRK Supply-Chain Campaign: Confirmed GitHub Footprint Grows 6.5x Since March (JADESNOW/Beavertail/InvisibleFerret Loaders, DEV#POPPER & OmniStealer Payloads)
- ViteVenom: Blockchain-C2 npm Supply Chain Malware Targets Vite Ecosystem (Sequel to ChainVeil, PolinRider Cluster)
- PolinRider: North Korea-Linked Supply Chain Campaign Expands Across npm, Packagist, Go Modules, and Chrome Extensions
- DPRK Contagious Interview Supply Chain RAT Campaign via npm, PyPI, and Multi-Ecosystem Package Poisoning
- ViteVenom Campaign: Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver RAT
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 26 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1195, T1566, T1204, T1059, T1059, T1620, T1547, T1543, T1027, T1001