PolinRider Malware Returns in 10 Hijacked npm Packages Using Ethereum Blockchain to Deliver Malicious Code

Sonatype has documented a new wave of PolinRider malware in 12 releases across 10 hijacked npm packages, investigated on November 4, 2026, whose concealed loaders use Ethereum transactions to discover payload servers and execute downloaded code when an affected entrypoint loads, with no install script required. Stages retrieved by researchers install a Node remote-access trojan and persistence targeting tools including VS Code, Cursor, Discord and GitHub Desktop, and Sonatype links the loaders to previously documented PolinRider activity through an identical Ethereum wallet and matching stage paths.