Hackers Hijack 10 npm Packages to Spread PolinRider Malware Using Ethereum Blockchain

Attackers compromised 10 legitimate npm packages and injected obfuscated malware (PolinRider) that queries Ethereum blockchain transactions to dynamically retrieve command-and-control server IP addresses — a novel technique that evades traditional signature-based and install-hook detection. This supply chain attack is particularly dangerous because developers unknowingly pull malicious code into their build pipelines when updating or installing packages they already trust. The use of blockchain as a decentralized C2 lookup mechanism makes it extremely difficult to block or take down the infrastructure through conventional domain/IP blocking. Without continuous dependency scanning and package integrity verification, organisations may not discover the compromise until malware has already executed and exfiltrated data.