PolinRider DPRK npm Supply-Chain Loader Uses Blockchain Dead Drops for C2 (BeaverTail/InvisibleFerret)

PolinRider DPRK npm Supply-Chain Loader Uses Blockchain Dead (TL-2026-1215), also tracked as PolinRider, is a high-severity supply-chain compromise, first published 2026-07-11 and last reviewed 2026-08-04. It is attributed to Lazarus Group (North Korea) with high confidence, affects npm (deepthought26 publisher account) tailwind-color-shades, maps to 35 MITRE ATT&CK techniques (T1001, T1005, T1016), and is covered by 9 detection rules and 26 indicators of compromise.

Key facts for TL-2026-1215

Threat ID
TL-2026-1215
Also known as
PolinRider, A6-Shadow-15, A6-Shadow-14
Severity
HIGH
Status
ACTIVE
Category
SUPPLY_CHAIN
First published
2026-07-11
Last reviewed
2026-08-04
Attribution
Lazarus Group
Attribution confidence
HIGH
Nation-state nexus
North Korea
Motivation
FINANCIAL
Target sectors
technology, software development, cryptocurrency, finance
Target regions
Global
Detection rules
9
Indicators of compromise
26
Updates
2026-08-04

Malware and tooling in PolinRider DPRK npm Supply-Chain Loader Uses Blockchain Dead

Malware and tooling: BeaverTail - S1246, InvisibleFerret - S1245, PolinRider, AnyDesk

DPRK-attributed (Lazarus / Contagious Interview) supply-chain campaign PolinRider (A6-Shadow-15/A6-Shadow-14) trojanizes npm packages tailwind-color-shades 1.0.2 and safe-validate 1.0.4, published by account deepthought26. On import, the loader queries TRON and Aptos blockchains to locate payload addresses, decrypts an XOR-encoded payload from Binance Smart Chain burn-address transactions, then fetches a final stage over version-gated HTTP endpoints, delivering the BeaverTail stager followed by the InvisibleFerret RAT.

How PolinRider DPRK npm Supply-Chain Loader Uses Blockchain Dead works

PolinRider is a DPRK-attributed npm supply-chain loader first documented in a June 22, 2026 reverse-engineering writeup by researcher Melted in Hex, tracked internally under campaign markers A6-Shadow-15 (tailwind-color-shades 1.0.2) and A6-Shadow-14 (safe-validate 1.0.4). Both packages were published to the npm registry under the account deepthought26 and execute at import time rather than via install hooks: a single `import './src/bootstrap'` statement at the top of index.ts (or `require('./schema/bootstrap')` in the CommonJS variant) means the payload fires the moment a bundler or build tool resolves the module graph, and a `"sideEffects"` array in package.json (listing `./lib/bootstrap.js`) defeats tree-shaking that would otherwise strip the dead code.

The loader is wrapped in a multi-layer obfuscation stack: a custom character-shuffle decoder (dubbed the 'NVu' algorithm, using a seeded index permutation), Function-constructor-based eval (to avoid literal `eval` tokens that static scanners flag), obfuscator.io string-array rotation, and a final XOR layer over the fetched payload. A global marker variable (`global['_V'] = 'A6-Shadow-15'` or `'A6-Shadow-14'`) identifies the campaign/build to the operators.

The defining innovation is the C2 resolution mechanism: instead of a static domain or IP, the loader queries the TRON blockchain (primary resolver, e.g. account TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP) with an Aptos account as fallback (e.g. 0xbe0374...0811e). These accounts point to a Binance Smart Chain (BSC) transaction sent to a burn address (0x...dEaD), making the payload transaction immutable, unspendable, and effectively un-sinkholable and un-seizable by defenders or registrars. The transaction data is decrypted with a per-campaign XOR key (e.g. `2[gWfGj;<:-93Z^C` for the primary resolver, `m6:tTh^D)cBz?NM]` for the secondary) to yield the address of the next-stage HTTP endpoint. A third 'rotation pointer' account (TRON TA48dct6rFW8BXsiLAtjFaVFoSuryMjD3v / Aptos 0x533b2d...83e0b1) allows operators to rotate infrastructure without republishing the npm package, since the on-chain pointer — not the npm artifact — is what changes.

Once resolved, the loader issues `GET http://<c2-ip>/$/boot` with a custom `Sec-V` HTTP header carrying the campaign/version marker (e.g. `A6-Shadow-15`). Observed C2 hosts are 166.88.54.158 (ports 80/443, serving the 'A6-Shadow-15' cohort), 198.105.127.210 (ports 80/443, a numeric-marker cohort), and 23.27.202.27 (ports 443/27017, the default cohort). The HTTP response body is itself XOR-encrypted with a further key (`ThZG+0jfXE6VAGOJ`) before being decoded into the next stage.

The delivered payload chain begins with BeaverTail (MITRE ATT&CK S1246), a JavaScript/C++ credential-stealing loader used by DPRK's Contagious Interview cluster (G1052, aka DeceptiveDevelopment, Gwisin Gang, Tenacious Pungsan, DEV#POPPER, PurpleBravo, TAG-121) since 2022. BeaverTail fingerprints the host OS, harvests browser-stored credentials and cryptocurrency wallet data (MetaMask, Phantom, Binance, Coinbase, Solana), and downloads a bundled Python runtime ('p.zip') to launch InvisibleFerret (MITRE ATT&CK S1245), a modular Python RAT with main, payload, browser, and AnyDesk modules providing keylogging, clipboard capture, SSH key theft, environment-variable harvesting (AWS/GCP/npm/GitHub tokens), and remote access via bundled AnyDesk. A cleanup routine force-pushes the compromised developer's git repositories while preserving original commit timestamps to hide evidence of tampering.

This PolinRider variant is part of the broader, long-running DPRK 'Contagious Interview' supply-chain operation that has repeatedly trojanized npm packages (e.g. postcss-optimizer/yolorabbit in a related 2026 incident) to target software developers and cryptocurrency professionals, with the blockchain dead-drop mechanism representing a novel evolution intended to defeat conventional C2 sinkholing and domain/IP takedown actions.

MITRE ATT&CK techniques used in TL-2026-1215

command-and-control

T1001 Data Obfuscation

Collection

T1005 Data from Local System; T1074 Data Staged; T1115 Clipboard Data; T1560 Archive Collected Data

Discovery

T1016 System Network Configuration Discovery; T1033 System Owner/User Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1217 Browser Information Discovery; T1518 Software Discovery

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1564 Hide Artifacts

Exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

Credential Access

T1056 Input Capture; T1555 Credentials from Password Stores

Execution

T1059 Command and Scripting Interpreter; T1204 User Execution

Command and Control

T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer; T1219 Remote Access Tools; T1571 Non-Standard Port; T1573 Encrypted Channel

Initial Access

T1195 Supply Chain Compromise; T1566 Phishing

Persistence

T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution

stealth

T1620 Reflective Code Loading

Impact

T1657 Financial Theft

Affected products and versions in PolinRider DPRK npm Supply-Chain Loader Uses Blockchain Dead

  • npm (deepthought26 publisher account) — tailwind-color-shades
    Vulnerable versions: 1.0.2
  • npm (deepthought26 publisher account) — safe-validate
    Vulnerable versions: 1.0.4

Remediation for PolinRider DPRK npm Supply-Chain Loader Uses Blockchain Dead

Immediate actions

  • Block/remove npm packages tailwind-color-shades 1.0.2 and safe-validate 1.0.4 from developer environments and internal registry mirrors
  • Block outbound connections to C2 IPs 166.88.54.158, 198.105.127.210, and 23.27.202.27
  • Alert on HTTP requests to path '/$/boot' or containing a 'Sec-V' request header
  • Suspend/report the npm publisher account deepthought26
  • Rotate credentials and cryptocurrency wallet keys on any developer workstation that installed the affected packages
  • Audit git repositories for force-pushes with preserved-but-suspicious commit timestamps

Workarounds

  • Pin dependency versions and use a private npm proxy/registry that vets new package versions before promotion

Longer-term hardening

  • Deploy software composition analysis (SCA) / npm supply-chain scanning in CI that flags import-time side effects and sideEffects package.json overrides
  • Monitor build-time network egress from CI/CD and developer machines to blockchain RPC endpoints (trongrid.io, aptoslabs.com, bsc-dataseed.binance.org) as a detection signal, not a blanket block
  • Enforce npm package allowlisting / lockfile integrity verification and provenance attestation (npm provenance, Sigstore)
  • Deploy EDR with behavioral detection for Python-based RATs and AnyDesk abuse
  • Train developers on Contagious Interview social-engineering lures (fake job interviews, coding challenges)

Weaknesses (CWE) in PolinRider DPRK npm Supply-Chain Loader Uses Blockchain Dead

CWE-506, CWE-829, CWE-494

Timeline of PolinRider DPRK npm Supply-Chain Loader Uses Blockchain Dead

  • BeaverTail malware first observed in use by DPRK-linked Contagious Interview cluster.
  • InvisibleFerret Python RAT first documented as second-stage payload deployed by Contagious Interview.
  • OpenSourceMalware research team initially identifies the broader PolinRider campaign, finding obfuscated JavaScript loaders delivering BeaverTail variants across hundreds of public GitHub repositories.
  • Microsoft publishes threat intelligence on Contagious Interview fake job interview malware campaigns.
  • PolinRider campaign tracked as having compromised 1,951 public GitHub repositories across 1,047 unique repository owners; npm publisher accounts allavin and blackedward deleted/scrubbed from the registry around this time.
  • Source repository deepthought26/schema-checker (backing the safe-validate npm package) created; clean versions 1.0.1-1.0.3 of safe-validate published to npm the same day.
  • Weaponized safe-validate 1.0.4 published with the tree-shaking-defeating 'sideEffects' package.json flag targeting bootstrap.js; tailwind-color-shades republished the same day, indicating coordinated multi-package campaign expansion under the deepthought26 account.
  • Researcher Melted in Hex publishes 'Dead Drops on the Blockchain' reverse-engineering writeup and discloses findings on X/Twitter same day; entry added to Malpedia.
  • Malicious npm packages tailwind-color-shades 1.0.2 and safe-validate 1.0.4 flagged on npm under account deepthought26, detected by scanner monitoring recent-publish feeds.
  • Archived snapshot of the disclosure blog post created via Wayback Machine.
  • The Hacker News reports the expanded PolinRider campaign has published 108 unique malicious packages/extensions (162 release artifacts total: 19 npm libraries, 10 Composer packages, 61 Go modules, and one Chrome extension) across npm, Packagist, Go, and Chrome platforms.
  • OpenSourceMalware publishes 'PolinRider Rides Again' follow-up documenting campaign expansion beyond npm into Packagist, Go Modules, and a Chrome extension.
  • Threadlinqs Intelligence completes deep-dive research and MITRE ATT&CK mapping of the PolinRider campaign.

Update history for TL-2026-1215

  • 2026-08-04 — tweetfeed.live community intel: New TL_OSINT_Scan community intel: 1 newly-corroborated indicator(s), 113 community-related indicator(s).

Sources cited for PolinRider DPRK npm Supply-Chain Loader Uses Blockchain Dead

Threats related to PolinRider DPRK npm Supply-Chain Loader Uses Blockchain Dead

Detection coverage for TL-2026-1215

As of 2026-08-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1215 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-1215

1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats