# PolinRider DPRK npm Supply-Chain Loader Uses Blockchain Dead Drops for C2 (BeaverTail/InvisibleFerret)

> DPRK-attributed (Lazarus / Contagious Interview) supply-chain campaign PolinRider (A6-Shadow-15/A6-Shadow-14) trojanizes npm packages tailwind-color-shades 1.0.2 and safe-validate 1.0.4, published by account deepthought26. On import, the loader queries TRON and Aptos blockchains to locate payload addresses, decrypts an XOR-encoded payload from Binance Smart Chain burn-address transactions, then fetches a final stage over version-gated HTTP endpoints, delivering the BeaverTail stager followed by the InvisibleFerret RAT.

- **Published:** 2026-07-11T00:00:00Z
- **Last reviewed:** 2026-08-04T20:00:17Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1215
- **ID:** TL-2026-1215
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** Lazarus Group (North Korea)
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)

## Description

PolinRider is a DPRK-attributed npm supply-chain loader first documented in a June 22, 2026 reverse-engineering writeup by researcher Melted in Hex, tracked internally under campaign markers A6-Shadow-15 (tailwind-color-shades 1.0.2) and A6-Shadow-14 (safe-validate 1.0.4). Both packages were published to the npm registry under the account deepthought26 and execute at import time rather than via install hooks: a single `import './src/bootstrap'` statement at the top of index.ts (or `require('./schema/bootstrap')` in the CommonJS variant) means the payload fires the moment a bundler or build tool resolves the module graph, and a `"sideEffects"` array in package.json (listing `./lib/bootstrap.js`) defeats tree-shaking that would otherwise strip the dead code.

The loader is wrapped in a multi-layer obfuscation stack: a custom character-shuffle decoder (dubbed the 'NVu' algorithm, using a seeded index permutation), Function-constructor-based eval (to avoid literal `eval` tokens that static scanners flag), obfuscator.io string-array rotation, and a final XOR layer over the fetched payload. A global marker variable (`global['_V'] = 'A6-Shadow-15'` or `'A6-Shadow-14'`) identifies the campaign/build to the operators.

The defining innovation is the C2 resolution mechanism: instead of a static domain or IP, the loader queries the TRON blockchain (primary resolver, e.g. account TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP) with an Aptos account as fallback (e.g. 0xbe0374...0811e). These accounts point to a Binance Smart Chain (BSC) transaction sent to a burn address (0x...dEaD), making the payload transaction immutable, unspendable, and effectively un-sinkholable and un-seizable by defenders or registrars. The transaction data is decrypted with a per-campaign XOR key (e.g. `2[gWfGj;<:-93Z^C` for the primary resolver, `m6:tTh^D)cBz?NM]` for the secondary) to yield the address of the next-stage HTTP endpoint. A third 'rotation pointer' account (TRON TA48dct6rFW8BXsiLAtjFaVFoSuryMjD3v / Aptos 0x533b2d...83e0b1) allows operators to rotate infrastructure without republishing the npm package, since the on-chain pointer — not the npm artifact — is what changes.

Once resolved, the loader issues `GET http://<c2-ip>/$/boot` with a custom `Sec-V` HTTP header carrying the campaign/version marker (e.g. `A6-Shadow-15`). Observed C2 hosts are 166.88.54.158 (ports 80/443, serving the 'A6-Shadow-15' cohort), 198.105.127.210 (ports 80/443, a numeric-marker cohort), and 23.27.202.27 (ports 443/27017, the default cohort). The HTTP response body is itself XOR-encrypted with a further key (`ThZG+0jfXE6VAGOJ`) before being decoded into the next stage.

The delivered payload chain begins with BeaverTail (MITRE ATT&CK S1246), a JavaScript/C++ credential-stealing loader used by DPRK's Contagious Interview cluster (G1052, aka DeceptiveDevelopment, Gwisin Gang, Tenacious Pungsan, DEV#POPPER, PurpleBravo, TAG-121) since 2022. BeaverTail fingerprints the host OS, harvests browser-stored credentials and cryptocurrency wallet data (MetaMask, Phantom, Binance, Coinbase, Solana), and downloads a bundled Python runtime ('p.zip') to launch InvisibleFerret (MITRE ATT&CK S1245), a modular Python RAT with main, payload, browser, and AnyDesk modules providing keylogging, clipboard capture, SSH key theft, environment-variable harvesting (AWS/GCP/npm/GitHub tokens), and remote access via bundled AnyDesk. A cleanup routine force-pushes the compromised developer's git repositories while preserving original commit timestamps to hide evidence of tampering.

This PolinRider variant is part of the broader, long-running DPRK 'Contagious Interview' supply-chain operation that has repeatedly trojanized npm packages (e.g. postcss-optimizer/yolorabbit in a related 2026 incident) to target software developers and cryptocurrency professionals, with the blockchain dead-drop mechanism representing a novel evolution intended to defeat conventional C2 sinkholing and domain/IP takedown actions.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1620 Reflective Code Loading
- T1547 Boot or Logon Autostart Execution
- T1543 Create or Modify System Process
- T1027 Obfuscated Files or Information
- T1001 Data Obfuscation
- T1036 Masquerading
- T1564 Hide Artifacts
- T1140 Deobfuscate/Decode Files or Information
- T1070 Indicator Removal
- T1082 System Information Discovery
- T1217 Browser Information Discovery
- T1083 File and Directory Discovery
- T1016 System Network Configuration Discovery
- T1057 Process Discovery
- T1518 Software Discovery
- T1033 System Owner/User Discovery
- T1555 Credentials from Password Stores
- T1056 Input Capture
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1074 Data Staged
- T1115 Clipboard Data
- T1102 Web Service
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1571 Non-Standard Port
- T1105 Ingress Tool Transfer
- T1219 Remote Access Tools
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Sources

- [Dead Drops on the Blockchain: Reversing a DPRK npm Loader (PolinRider / A6-Shadow-15)](https://meltedinhex.com/posts/polinrider-blockchain-dead-drop-npm/)
- [Dead Drops on the Blockchain (archived)](https://web.archive.org/20260628181301/https://meltedinhex.com/posts/polinrider-blockchain-dead-drop-npm/)
- [PolinRider - Malpedia](https://malpedia.caad.fkie.fraunhofer.de/library/c53fa194-860d-479e-8aa2-a9fb3aee37c6/)
- [InvisibleFerret, Software S1245 | MITRE ATT&CK](https://attack.mitre.org/software/S1245/)
- [BeaverTail, Software S1246 | MITRE ATT&CK](https://attack.mitre.org/software/S1246/)
- [Contagious Interview, Group G1052 | MITRE ATT&CK](https://attack.mitre.org/groups/G1052/)
- [Contagious Interview: Malware delivered through fake developer job interviews](https://www.microsoft.com/en-us/security/blog/2026/03/11/contagious-interview-malware-delivered-through-fake-developer-job-interviews/)
- [North Korean APT Lazarus Targets Developers with Malicious npm Package](https://socket.dev/blog/north-korean-apt-lazarus-targets-developers-with-malicious-npm-package)
- [North Korean APTs Target Node.js Ecosystem: BeaverTail-OtterCookie JavaScript Malware Exploits npm Supply Chain](https://www.rescana.com/post/north-korean-apts-target-node-js-ecosystem-beavertail-ottercookie-javascript-malware-exploits-npm-s/)
- [InvisibleFerret Malware Attacking Windows Users Through Fake Job Interview Tactics](https://cybersecuritynews.com/invisibleferret-malware-attacking-windows/)
- [PolinRider: DPRK Threat Actor That Compromised Hundreds of GitHub Repos Is Unmasked](https://opensourcemalware.com/blog/polinrider-attack)
- [PolinRider Rides Again: North Korean Attack Expands Across GitHub](https://opensourcemalware.com/blog/polinrider-rides-again)
- [North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign](https://thehackernews.com/2026/07/north-korean-hackers-publish-108.html)
- [Active Exploitation Alert: North Korean PolinRider Supply Chain Attack Targets npm, Packagist, Go Modules, and Chrome Extensions](https://www.rescana.com/post/active-exploitation-alert-north-korean-polinrider-supply-chain-attack-targets-npm-packagist-go-modules-and-chrome-extens)
- [OpenSourceMalware/PolinRider technical dossier](https://github.com/OpenSourceMalware/PolinRider)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1215