[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQsu9btQBIzd9tZPA-gSAgGhpKGC2WLVLM-D1Naxy_-k":3},{"article":4,"iocs":54,"watch_terms":63,"solutions":64,"lesson":156},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"26833a5a-568d-4b4e-b2c9-8e2e0a4aee45","Hackers Hijack 10 npm Packages to Spread PolinRider Malware Using Ethereum Blockchain","hackers-hijack-10-npm-packages-to-spread-polinrider-malware-using-ethereum-block-51d343","Attackers have taken over 10 npm packages and slipped hidden code into 12 releases. The code uses the Ethereum blockchain to find a server and download more malware. Sonatype Research Labs confirmed the finding on November 4, 2026, and tracks it as sonatype-2026-010515, with a high severity score of 8.7. PolinRider malware The hijacked packages […] The post Hackers Hijack 10 npm Packages to Spread PolinRider Malware Using Ethereum Blockchain appeared first on Cyber Security News.","Attackers compromised 10 npm packages across 12 malicious releases, injecting obfuscated code that uses Ethereum blockchain to locate command-and-control servers. The PolinRider malware decodes transaction data to extract server IP addresses and downloads additional payloads via HTTP, bypassing traditional install-hook detection. Sonatype Research Labs identified the attack on November 4, 2026 (CVE sonatype-2026-010515, severity 8.7), linking it to the broader GhostAction campaign and earlier PolinRider activity dating back to May 2025.","Attackers compromise 10 npm packages with PolinRider malware using Ethereum blockchain for C2.","https:\u002F\u002Fcybersecuritynews.com\u002Fhackers-hijack-10-npm-packages-to-spread-polinrider-malware-using-ethereum-blockchain\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FPolinRider-malware-1.webp","2026-11-09T12:39:03+00:00","2026-11-09T13:00:30.426251+00:00",9,[17,20,23,26,28,31],{"name":18,"type":19},"PolinRider","threat_actor",{"name":21,"type":22},"GhostAction","campaign",{"name":24,"type":25},"Sonatype Research Labs","vendor",{"name":27,"type":25},"GitGuardian",{"name":29,"type":30},"npm","technology",{"name":32,"type":30},"Ethereum blockchain","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":33,"icon":35,"name":36,"slug":37},null,"Supply Chain","supply-chain",[39,44,49],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":50},{"id":51,"icon":35,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59,61],{"type":56,"value":57,"context":58},"ip","95.135.181.151","PolinRider C2 server advertised via Ethereum transaction on November 3, 2026",{"type":43,"value":18,"context":60},"Blockchain-based loader malware targeting npm packages and GitHub repositories",{"type":43,"value":21,"context":62},"Campaign targeting tens of thousands of GitHub repositories, shares infrastructure with PolinRider",[24,27],{"controls":65,"vendors":152},[66,95,123],{"slug":67,"name":68,"problem":69,"products":70},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[71,79,87],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":53,"name":96,"problem":97,"products":98},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"slug":124,"name":125,"problem":126,"products":127},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[128,136,144],{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",[153],{"slug":145,"name":146,"logo_path":147,"roles":154},[155],"reported_by",{"slug":157,"title":158,"body":159,"framework_refs":160,"framework_notes":168},"hijacked-npm-packages-use-ethereum-blockchain-to-hide-c2-servers","Hijacked npm Packages Use Ethereum Blockchain to Hide C2 Servers","Attackers compromised 10 legitimate npm packages and injected obfuscated malware (PolinRider) that queries Ethereum blockchain transactions to dynamically retrieve command-and-control server IP addresses — a novel technique that evades traditional signature-based and install-hook detection. This supply chain attack is particularly dangerous because developers unknowingly pull malicious code into their build pipelines when updating or installing packages they already trust. The use of blockchain as a decentralized C2 lookup mechanism makes it extremely difficult to block or take down the infrastructure through conventional domain\u002FIP blocking. Without continuous dependency scanning and package integrity verification, organisations may not discover the compromise until malware has already executed and exfiltrated data.",[161,162,163,164,165,166,167],"CIS Control 7: Continuous Vulnerability Management","OWASP A06:2021 Vulnerable and Outdated Components","NIST SP 800-53 SI-2: Flaw Remediation","MITRE ATT&CK T1566: Phishing","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":169,"MITRE ATT&CK T1566: Phishing":170,"NIST SP 800-53 SI-2: Flaw Remediation":171,"CIS Control 17: Incident Response Management":172,"OWASP A06:2021 Vulnerable and Outdated Components":173,"CIS Control 7: Continuous Vulnerability Management":174,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":175},"NIS2 requires essential and important entities to implement supply chain security measures covering relationships with direct suppliers; the hijacked npm packages exploit exactly the trust relationship with third-party software suppliers that this article mandates be managed and secured.","While not phishing in the traditional sense, the GhostAction campaign's use of seemingly legitimate package updates as a delivery vector mirrors the trust-abuse principle ATT&CK documents; the broader supply-chain technique (T1195.001: Compromise Software Dependencies) is closely related and highlights the need for dependency integrity controls.","SI-2 requires organisations to identify, report, and correct information system flaws, including vulnerabilities in third-party software components like npm packages, within defined timeframes — a process that would have triggered rapid patch\u002Frollback here.","Detecting and containing PolinRider across multiple projects requires a practised incident response plan that includes procedures for compromised dependencies — without it, teams lack the playbooks to quickly isolate affected builds and assess the blast radius of the GhostAction campaign.","This attack is a textbook A06 scenario — malicious code was injected into trusted open-source components; OWASP's guidance on verifying package integrity and using SCA tools directly addresses how to prevent such supply chain poisoning.","Continuous scanning of third-party dependencies would have flagged the 10 compromised npm packages shortly after Sonatype's November 4 disclosure, enabling rapid removal before the malware executed in production pipelines.","A.8.8 mandates timely identification and remediation of technical vulnerabilities in software used by the organisation, which would require tracking open-source package advisories and acting on the CVE sonatype-2026-010515 (severity 8.7) promptly."]