Filtered by tag: javascript × Clear
Hackers Hijack 10 npm Packages to Spread PolinRider Malware Using Ethereum Blockchain
Matched: health
Attackers hijacked 10 npm packages across 12 releases, injecting malware that uses the Ethereum blockchain as a dead drop to locate command servers. Tracked as sonatype-2026-010515 with a severity score of 8.7, the PolinRider malware reads server IP addresses from blockchain transactions, fetches XOR-encoded JavaScript, and runs it persistently even after the host app closes. Unlike typical npm malware, it triggers on import rather than install hooks, bypassing common defenses. Teams should audit lockfiles, check process and network logs for detached Node processes or port-443 HTTP requests to /0x/cls or /0x/ls, and rotate any exposed secrets.