PolinRider Loader Reappears in Hijacked npm Packages (12 malicious releases across 10 packages)

Key facts for PolinRider npm loader

Detection coverage for PolinRider npm loader

As of 2026-11-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5261 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: PolinRider (TL-2026-5261) Loader Execution — Detached 'node -i' Spawned by Node

Detects the host-side execution marker Sonatype observed for the PolinRider loaders in hijacked npm packages (sonatype-2026-010515): a detached 'node -i' interactive process with piped stdin launched by another Node process. The hijacked releases have no install hooks and run at module load (e.g. require('cdeops/client')) or app start (server-hemera-mongo dist/main.js), so this child-process pattern indicates the loader executed and the host should be treated as compromised. TL-2026-5261.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1059.007, T1195.002
• Data sources: sysmon, sysmon_linux
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype="sysmon:linux") EventCode=1 (Image="*node.exe" OR Image="*/node") (ParentImage="*node.exe" OR ParentImage="*/node")
```TL-2026-5261 PolinRider loader: node -i interactive child spawned by a node parent```
| regex CommandLine="(?i)node([.]exe)?[^ ]?[ ]+(-i|--interactive)([ ]|$)"
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_line values(ParentCommandLine) as parent_command_line by host User ParentImage Image
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ('node', 'node.exe') and InitiatingProcessFileName in~ ('node', 'node.exe')
| where ProcessCommandLine matches regex 'node([.]exe)?[^ ]?[ ]+(-i|--interactive)([ ]|$)'
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName
| order by Timestamp desc

Sigma

title: PolinRider Loader Execution - Detached Node Interactive Process Spawned by Node
id: 1a6f3c82-d4b7-4e95-a028-7c59b3e1d6f4
status: experimental
description: Detects a Node interactive process (node -i) launched by another Node process, the host-side execution marker observed for PolinRider loaders in hijacked npm packages (TL-2026-5261, sonatype-2026-010515).
references:
    - https://www.sonatype.com/blog/polinrider-loader-reappears-in-hijacked-npm-packages
    - https://blog.gitguardian.com/ghostaction-x-polinrider/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-04
tags:
    - attack.execution
    - attack.t1059.007
    - attack.initial-access
    - attack.t1195.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\node.exe'
        ParentImage|endswith: '\node.exe'
    selection_cli_end:
        CommandLine|endswith:
            - ' -i'
            - ' -i"'
            - ' --interactive'
    selection_cli_mid:
        CommandLine|contains:
            - ' -i '
            - ' --interactive '
    condition: selection_img and 1 of selection_cli_*
falsepositives:
    - Developers or build scripts that deliberately spawn a Node REPL from a Node-based tool
level: high

Known false positives:

• Developer tooling or test harnesses that intentionally spawn a Node REPL from a Node parent process
• Custom CLI wrappers that start 'node -i' for debugging sessions

Tuning notes: Exclude known developer workstations or specific ParentCommandLine values that legitimately launch a REPL. Prioritise hits on build servers, CI runners and production hosts, where an interactive Node child is highly anomalous. Correlate with npm install history for the 12 affected releases and, on a hit, rotate publishing keys, cloud credentials and CI secrets.

• 🔒 PolinRider (TL-2026-5261) Hijacked npm Release Installed — Affected Package Versions in Package-Manager Command Lines · unlock with TL Creds
• 🔒 PolinRider (TL-2026-5261) Font-File Masquerade Artifacts — fa-solid-400.woff2 / fa-solid-300.ttf and Known Hashes · unlock with TL Creds
• 🔒 PolinRider (TL-2026-5261) C2 Connection — Endpoint Traffic to [indicator] · unlock with TL Creds
• 🔒 PolinRider (TL-2026-5261) Obfuscated Inline Node Execution — eval(atob()) / Function Constructor · unlock with TL Creds
• 🔒 PolinRider (TL-2026-5261) Node Executing a Font File as a Script (Masquerade File Type) · unlock with TL Creds
• 🔒 PolinRider (TL-2026-5261) Stage Retrieval — Plain HTTP on TCP 443 for /0x/cls and /0x/ls · unlock with TL Creds
• 🔒 PolinRider (TL-2026-5261) Runner Staging — .npm-ws-runner.js Under Hidden .node_modules · unlock with TL Creds
• 🔒 PolinRider (TL-2026-5261) Blockchain Dead-Drop Lookup — Node DNS Queries to Ethereum RPC / Blockscout · unlock with TL Creds

Indicators of compromise for PolinRider npm loader

As of 2026-11-04, Threadlinqs Intelligence tracks 25 indicators of compromise for TL-2026-5261.

Sample indicators (3 of 25)

• IP address: 95.135.181[.]151
• File hash: b59e598ded824c7318ca9fae4e9a6d98c9600873677ece7d9896870e3e7ced8e
• File hash: 7ba0a30eabfa46008d6417532533199bbf351b27f3841477e9133f43fb404d24

Defanged, TLP:CLEAR. Full set of 25 indicators: unlock with TL Creds.

How PolinRider npm loader works

Sonatype ties the activity to PolinRider through the same wallet and overlapping C2 infrastructure.

On 2026-11-04 Sonatype disclosed 12 malicious releases across 10 npm packages (tracking ID sonatype-2026-010515) that embed PolinRider loaders. The affected releases are @adminide-stack/client-redux 0.0.16-18, @adminide-stack/health-api-server 0.0.18-alpha.465, @adminide-stack/user-activity-browser 1.1.3-alpha.114, @adminide-stack/utils 0.0.16-129 and 0.0.16-130, server-hemera-mongo 0.0.15 and 0.0.16, cdeops 13.5.31, @adminide-stack/forms-core 5.1.9-alpha.3, @adminide-stack/yantra-help-browser 12.0.194, @cdmbase/wiki-browser 12.0.18-alpha.53 and @pubngo-stack/help-browser 12.0.23-alpha.3.

The releases contain no install or postinstall hooks. The code runs when the module is loaded (for example require('cdeops/client')) or at application start-up (server-hemera-mongo via dist/main.js). Two obfuscation styles were observed: six releases hide the loader behind eval(atob(...)), and six use a character-permutation bootstrap that ends in the Function constructor.

The loader queries Ethereum RPC endpoints, with a Blockscout API fallback, for transactions sent by the hard-coded wallet 0x1eef0849eda15d87f64e51c73c8442cf3c8bcef3. It reads the first four bytes of the transaction recipient address as a primary IPv4 address and the next four bytes as a secondary one. This lets the operator move the payload server without republishing any package. The loader then fetches XOR-encoded JavaScript over plain HTTP on TCP 443 from paths /0x/cls and /0x/ls on the advertised C2 95.135.181.151, decodes it and executes it with eval()/Function. The Sec-V request header differs by variant: A10-npm_inject for the base64 releases, A10-II for utils@0.0.16-130 and A10-E for cdeops@13.5.31. On the host, Sonatype observed detached 'node -i' processes with piped stdin launched by another Node process.

Sonatype ties the activity to previously documented PolinRider activity through the identical wallet, matching C2 infrastructure and overlapping stage-retrieval paths, citing GitGuardian's 2026-10-27 report. It notes the IP was also observed on 2026-11-03 (Greenflagged). Broader PolinRider reporting from Socket and SecurityWeek describes a North Korea-linked campaign associated with Contagious Interview / Famous Chollima activity. It spans npm, Packagist, Go modules and Chrome extensions (162 artifacts across 108 packages), uses blockchain and public RPC infrastructure to retrieve XOR-encrypted payloads, and delivers DEV#POPPER and OmniStealer. The Sonatype source itself does not name a final payload or an actor for this specific wave, so attribution of these 12 releases rests on shared infrastructure only. If the code ran, treat the host as compromised and rotate all reachable credentials (publishing keys, cloud access, CI secrets).

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1036.008 Masquerading: Masquerade File Type; T1140 Deobfuscate/Decode Files or Information

Execution

T1059.007 Command and Scripting Interpreter: JavaScript

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1568 Dynamic Resolution

Initial Access

T1195 Supply Chain Compromise; T1195.002 Compromise Software Supply Chain

Remediation for PolinRider npm loader

Immediate actions

• Search lockfiles and direct/transitive dependencies for the 12 affected releases and remove them
• Block the affected versions in the repository manager / artifact proxy
• Block outbound traffic to 95.135.181.151 and alert on plain HTTP requests on port 443 using /0x/cls or /0x/ls
• Hunt for detached 'node -i' processes with piped stdin spawned by another Node process
• Treat hosts where the code executed as compromised and rotate publishing keys, cloud credentials and CI secrets

Workarounds

• Pin to versions published before the malicious releases until maintainers publish clean builds

Longer-term hardening

• Pin dependencies and enforce lockfile integrity in CI
• Monitor egress from build and developer hosts for Ethereum RPC / Blockscout lookups from Node processes
• Apply a dependency-quarantine or cooldown policy for newly published package versions

Affected and fixed versions

• npm — @adminide-stack/client-redux
  Vulnerable versions: 0.0.16-18
• npm — @adminide-stack/health-api-server
  Vulnerable versions: 0.0.18-alpha.465
• npm — @adminide-stack/user-activity-browser
  Vulnerable versions: 1.1.3-alpha.114
• npm — @adminide-stack/utils
  Vulnerable versions: 0.0.16-129; 0.0.16-130
• npm — server-hemera-mongo
  Vulnerable versions: 0.0.15; 0.0.16
• npm — cdeops
  Vulnerable versions: 13.5.31
• npm — @adminide-stack/forms-core
  Vulnerable versions: 5.1.9-alpha.3
• npm — @adminide-stack/yantra-help-browser
  Vulnerable versions: 12.0.194
• npm — @cdmbase/wiki-browser
  Vulnerable versions: 12.0.18-alpha.53
• npm — @pubngo-stack/help-browser
  Vulnerable versions: 12.0.23-alpha.3

Timeline of PolinRider npm loader

• 2025-12-01 Per Socket and SecurityWeek, the broader locked-ioc-21 campaign has been active since December 2025 (month-level date), using compromised repositories and obfuscated JavaScript loaders.
• 2026-06-23 Socket reports synchronized malicious modifications (10:00 UTC) to repositories of the compromised locked-ioc-23 GitHub account as the campaign expanded to Packagist.
• 2026-07-01 Socket Threat Research publishes its locked-ioc-21 analysis: 162 malicious artifacts across 108 packages (npm, Packagist, Go modules, Chrome extension) delivering locked-ioc-22 and locked-ioc-20.
• 2026-07-06 SecurityWeek reports the North Korea-linked locked-ioc-21 campaign, active since December 2025, citing the Socket findings.
• 2026-10-13 GitGuardian reports the GhostAction operator pushing 72,026 commits to 22,964 repositories between 2026-10-13 and 2026-10-21, reusing locked-ioc-21's VS Code folderOpen launcher for a font-file stealer.
• 2026-10-22 From 2026-10-22 to 2026-10-26, locked-ioc-21 loaders are force-pushed over GhostAction commits (188 commits overwritten), per GitGuardian.
• 2026-10-27 GitGuardian's locked-ioc-21 report, which documents the wallet 0x1eef...cef3 and fallback C2 locked-ioc-19:443, is cited by Sonatype as the basis for linking these npm releases.
• 2026-11-03 Greenflagged observes C2 IP locked-ioc-19, as cited by Sonatype.
• 2026-11-04 Sonatype discloses 12 malicious releases across 10 hijacked npm packages carrying locked-ioc-21 loaders (sonatype-2026-010515) and ties them to locked-ioc-21 via the shared wallet and C2.

Sources cited for PolinRider npm loader

• PolinRider: North Korea-Linked Supply Chain Campaign Expands Across Open Source Ecosystems (Socket) socket.dev · Research · 2026-07-01
• GhostAction Crosses Paths With PolinRider: Inside the October Escalation (GitGuardian) blog.gitguardian.com · Research · 2026-10-27
• Socket PolinRider supply-chain attack IOC tracker socket.dev · Research
• PolinRider Loader Reappears in Hijacked npm Packages (sonatype-2026-010515) sonatype.com · Blog · 2026-11-04
• Active Exploitation Alert: North Korean PolinRider Supply Chain Attack Targets npm, Packagist, Go Modules, and Chrome Extensions (Rescana) rescana.com · Blog
• North Korean Hackers Target Open Source Developers in Supply Chain Attacks (SecurityWeek) SecurityWeek · News · 2026-07-06
• North Korean PolinRider supply chain attack targets 108 unique repos (SC Media) scworld.com · News
• PolinRider supply chain attack expands to Packagist ecosystem (Developer Tech) developer-tech.com · News
• PolinRider: North Korea Floods npm, Packagist, Go, and Chrome With 108 Malicious Packages (Breached.Company) breached.company · News

More in supply chain

• NIKKE PC Game Launcher CDN Compromise Delivers K2F Remote Access and Data-Stealing Malware
• Malicious cPGuard Updates Served in OpsShield Supply Chain Attack (Update CDN Compromise, cPGuard 5.88.12-5.88.19)
• Supply Chain Attack Artifacts in GitHub Repositories and Developer Machines (Miasma, Shai-Hulud, ForceMemo, Megalodon, GhostAction, TeamPCP and others)
• Binance Wallet Infrastructure Compromise via Fake Job Interviews, Trojanized Homebrew Installer and Internal AI Tool Abuse (~$6.3B Theft, TraderTraitor)
• cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes (OPSSHIELD Supply-Chain Compromise)

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages