# PolinRider Loader Reappears in Hijacked npm Packages (12 malicious releases across 10 packages)

> Sonatype reports 12 malicious releases across 10 hijacked npm packages (@adminide-stack/*, server-hemera-mongo, cdeops, @cdmbase/wiki-browser, @pubngo-stack/help-browser) carrying PolinRider loaders. The loaders decode payload-server IPv4 addresses from Ethereum transactions sent by a hard-coded wallet, fetch XOR-encoded JavaScript over plain HTTP on port 443, and execute it via eval()/Function constructor. Sonatype ties the activity to PolinRider through the same wallet and overlapping C2 infrastructure.

- **Published:** 2026-11-04T19:33:06Z
- **Last reviewed:** 2026-11-04T19:33:06Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5261
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5261.png
- **ID:** TL-2026-5261
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** PolinRider operators (North Korea)
- **Detections:** 9 (1 shown free below) · **IOCs:** 25 (3 shown free below)

## Description

On 2026-11-04 Sonatype disclosed 12 malicious releases across 10 npm packages (tracking ID sonatype-2026-010515) that embed PolinRider loaders. The affected releases are @adminide-stack/client-redux 0.0.16-18, @adminide-stack/health-api-server 0.0.18-alpha.465, @adminide-stack/user-activity-browser 1.1.3-alpha.114, @adminide-stack/utils 0.0.16-129 and 0.0.16-130, server-hemera-mongo 0.0.15 and 0.0.16, cdeops 13.5.31, @adminide-stack/forms-core 5.1.9-alpha.3, @adminide-stack/yantra-help-browser 12.0.194, @cdmbase/wiki-browser 12.0.18-alpha.53 and @pubngo-stack/help-browser 12.0.23-alpha.3.

The releases contain no install or postinstall hooks. The code runs when the module is loaded (for example require('cdeops/client')) or at application start-up (server-hemera-mongo via dist/main.js). Two obfuscation styles were observed: six releases hide the loader behind eval(atob(...)), and six use a character-permutation bootstrap that ends in the Function constructor.

The loader queries Ethereum RPC endpoints, with a Blockscout API fallback, for transactions sent by the hard-coded wallet 0x1eef0849eda15d87f64e51c73c8442cf3c8bcef3. It reads the first four bytes of the transaction recipient address as a primary IPv4 address and the next four bytes as a secondary one. This lets the operator move the payload server without republishing any package. The loader then fetches XOR-encoded JavaScript over plain HTTP on TCP 443 from paths /0x/cls and /0x/ls on the advertised C2 95.135.181.151, decodes it and executes it with eval()/Function. The Sec-V request header differs by variant: A10-npm_inject for the base64 releases, A10-II for utils@0.0.16-130 and A10-E for cdeops@13.5.31. On the host, Sonatype observed detached 'node -i' processes with piped stdin launched by another Node process.

Sonatype ties the activity to previously documented PolinRider activity through the identical wallet, matching C2 infrastructure and overlapping stage-retrieval paths, citing GitGuardian's 2026-10-27 report. It notes the IP was also observed on 2026-11-03 (Greenflagged). Broader PolinRider reporting from Socket and SecurityWeek describes a North Korea-linked campaign associated with Contagious Interview / Famous Chollima activity. It spans npm, Packagist, Go modules and Chrome extensions (162 artifacts across 108 packages), uses blockchain and public RPC infrastructure to retrieve XOR-encrypted payloads, and delivers DEV#POPPER and OmniStealer. The Sonatype source itself does not name a final payload or an actor for this specific wave, so attribution of these 12 releases rests on shared infrastructure only. If the code ran, treat the host as compromised and rotate all reachable credentials (publishing keys, cloud access, CI secrets).

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1195.002 Compromise Software Supply Chain
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036.008 Masquerading: Masquerade File Type
- T1568 Dynamic Resolution
- T1071.001 Application Layer Protocol: Web Protocols

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**PolinRider (TL-2026-5261) Loader Execution — Detached 'node -i' Spawned by Node** (`TL-2026-5261-SPL-001`)

Detects the host-side execution marker Sonatype observed for the PolinRider loaders in hijacked npm packages (sonatype-2026-010515): a detached 'node -i' interactive process with piped stdin launched by another Node process. The hijacked releases have no install hooks and run at module load (e.g. require('cdeops/client')) or app start (server-hemera-mongo dist/main.js), so this child-process pattern indicates the loader executed and the host should be treated as compromised. TL-2026-5261.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1059.007, T1195.002
- **Data sources:** sysmon, sysmon_linux
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=sysmon (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype="sysmon:linux") EventCode=1 (Image="*node.exe" OR Image="*/node") (ParentImage="*node.exe" OR ParentImage="*/node")
```TL-2026-5261 PolinRider loader: node -i interactive child spawned by a node parent```
| regex CommandLine="(?i)node([.]exe)?[^ ]?[ ]+(-i|--interactive)([ ]|$)"
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_line values(ParentCommandLine) as parent_command_line by host User ParentImage Image
| convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ('node', 'node.exe') and InitiatingProcessFileName in~ ('node', 'node.exe')
| where ProcessCommandLine matches regex 'node([.]exe)?[^ ]?[ ]+(-i|--interactive)([ ]|$)'
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName
| order by Timestamp desc
```

### Sigma

```yaml
title: PolinRider Loader Execution - Detached Node Interactive Process Spawned by Node
id: 1a6f3c82-d4b7-4e95-a028-7c59b3e1d6f4
status: experimental
description: Detects a Node interactive process (node -i) launched by another Node process, the host-side execution marker observed for PolinRider loaders in hijacked npm packages (TL-2026-5261, sonatype-2026-010515).
references:
    - https://www.sonatype.com/blog/polinrider-loader-reappears-in-hijacked-npm-packages
    - https://blog.gitguardian.com/ghostaction-x-polinrider/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-04
tags:
    - attack.execution
    - attack.t1059.007
    - attack.initial-access
    - attack.t1195.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\node.exe'
        ParentImage|endswith: '\node.exe'
    selection_cli_end:
        CommandLine|endswith:
            - ' -i'
            - ' -i"'
            - ' --interactive'
    selection_cli_mid:
        CommandLine|contains:
            - ' -i '
            - ' --interactive '
    condition: selection_img and 1 of selection_cli_*
falsepositives:
    - Developers or build scripts that deliberately spawn a Node REPL from a Node-based tool
level: high
```

**Known false positives:**

- Developer tooling or test harnesses that intentionally spawn a Node REPL from a Node parent process
- Custom CLI wrappers that start 'node -i' for debugging sessions

**Tuning notes:** Exclude known developer workstations or specific ParentCommandLine values that legitimately launch a REPL. Prioritise hits on build servers, CI runners and production hosts, where an interactive Node child is highly anomalous. Correlate with npm install history for the 12 affected releases and, on a hit, rotate publishing keys, cloud credentials and CI secrets.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- PolinRider (TL-2026-5261) Hijacked npm Release Installed — Affected Package Versions in Package-Manager Command Lines (locked: unlock with TL Creds)
- PolinRider (TL-2026-5261) Font-File Masquerade Artifacts — fa-solid-400.woff2 / fa-solid-300.ttf and Known Hashes (locked: unlock with TL Creds)
- PolinRider (TL-2026-5261) C2 Connection — Endpoint Traffic to [indicator] (locked: unlock with TL Creds)
- PolinRider (TL-2026-5261) Obfuscated Inline Node Execution — eval(atob()) / Function Constructor (locked: unlock with TL Creds)
- PolinRider (TL-2026-5261) Node Executing a Font File as a Script (Masquerade File Type) (locked: unlock with TL Creds)
- PolinRider (TL-2026-5261) Stage Retrieval — Plain HTTP on TCP 443 for /0x/cls and /0x/ls (locked: unlock with TL Creds)
- PolinRider (TL-2026-5261) Runner Staging — .npm-ws-runner.js Under Hidden .node_modules (locked: unlock with TL Creds)
- PolinRider (TL-2026-5261) Blockchain Dead-Drop Lookup — Node DNS Queries to Ethereum RPC / Blockscout (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 25)

Defanged, TLP:CLEAR.

- IP address: `95.135.181[.]151`
- File hash: `b59e598ded824c7318ca9fae4e9a6d98c9600873677ece7d9896870e3e7ced8e`
- File hash: `7ba0a30eabfa46008d6417532533199bbf351b27f3841477e9133f43fb404d24`

Full set of 25 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [PolinRider Loader Reappears in Hijacked npm Packages (sonatype-2026-010515)](https://www.sonatype.com/blog/polinrider-loader-reappears-in-hijacked-npm-packages)
- [PolinRider: North Korea-Linked Supply Chain Campaign Expands Across Open Source Ecosystems (Socket)](https://socket.dev/blog/polinrider-north-korea-linked-supply-chain-campaign-expands)
- [North Korean Hackers Target Open Source Developers in Supply Chain Attacks (SecurityWeek)](https://www.securityweek.com/north-korean-hackers-target-open-source-developers-in-supply-chain-attacks/)
- [North Korean PolinRider supply chain attack targets 108 unique repos (SC Media)](https://www.scworld.com/news/north-korean-polinrider-supply-chain-attack-targets-108-unique-repos)
- [Active Exploitation Alert: North Korean PolinRider Supply Chain Attack Targets npm, Packagist, Go Modules, and Chrome Extensions (Rescana)](https://www.rescana.com/post/active-exploitation-alert-north-korean-polinrider-supply-chain-attack-targets-npm-packagist-go-modules-and-chrome-extens)
- [PolinRider supply chain attack expands to Packagist ecosystem (Developer Tech)](https://www.developer-tech.com/news/polinrider-supply-chain-attack-expands-packagist-ecosystem/)
- [PolinRider: North Korea Floods npm, Packagist, Go, and Chrome With 108 Malicious Packages (Breached.Company)](https://breached.company/polinrider-north-korea-108-malicious-packages-2026/)
- [GhostAction Crosses Paths With PolinRider: Inside the October Escalation (GitGuardian)](https://blog.gitguardian.com/ghostaction-x-polinrider/)
- [Socket PolinRider supply-chain attack IOC tracker](https://socket.dev/supply-chain-attacks/polinrider)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5261