PolinRider Returns in 17 Hijacked npm Packages: an eval(atob()) Loader Pulls Its C2 Address From an Ethereum Transaction and Runs a Crypto Stealer in Memory

Medium · 2026-11-05 · By H.A

Attackers published malicious versions of 17 legitimate npm packages, including several @adminide-stack and Tailwind form libraries, whose loader resolves C2 through the Ethereum blockchain and runs an XOR-obfuscated crypto-stealing stage via node -i.

Overview

Researchers have found a new wave of PolinRider malware hidden in malicious releases of 17 legitimate npm packages. Attackers took over existing maintainer accounts and published poisoned versions, rather than registering new lookalike package names. The injected loader in index.js looks up its command-and-control (C2) address in an Ethereum transaction, downloads a JavaScript stage that is XOR-obfuscated, and runs it in memory. The decoded code includes cryptocurrency-stealing logic.

The affected packages have about 1,400 combined weekly downloads. That is small for npm, but these packages sit in developer and CI environments where wallets, tokens and cloud keys are easy to reach. All of the listed versions have been removed from the registry.

The Campaign

The affected packages and malicious versions are:

• @adminide-stack/client-redux 0.0.16-18
• @adminide-stack/health-api-server 0.0.18-alpha.465
• @adminide-stack/user-activity-browser 1.1.3-alpha.114
• @adminide-stack/utils 0.0.16-129, 0.0.16-130
• @adminide-stack/forms-core 5.1.9-alpha.3
• @adminide-stack/yantra-help-browser 12.0.194
• @cdmbase/wiki-browser 12.0.18-alpha.53
• @pubngo-stack/help-browser 12.0.23-alpha.3
• server-hemera-mongo 0.0.15, 0.0.16
• cdeops 13.5.31
• react-contact-forms 0.5.2
• tailwindcss-form-utils 0.5.9
• tailwind-contact-forms 0.5.8
• tailwindcss-contact-form 0.5.5
• tailwind-form-core 0.5.5
• tailwind-input-kit 0.5.5
• tailwind-forms-kit 0.5.5

Timeline

• Earlier in 2026: PolinRider is seen in previous npm compromises that also used blockchain dead drops.
• Late October 2026: Researchers say the campaign returned about a week after a major cryptocurrency exchange theft.
• 4 November 2026: Public disclosure. The malicious versions are taken down.

Tradecraft

• Hidden loader: A line in index.js runs eval(atob(...)) to decode and execute a Base64 payload. A character-permutation bootstrap adds another layer of obfuscation.
• Blockchain dead drop: The loader queries public Ethereum RPC endpoints and reads a C2 IP address encoded in a transaction. Because the attacker can point victims to new infrastructure by sending another transaction, taking down a server does not end the campaign, and nothing in the package needs to change.
• Fileless second stage: The next stage is downloaded over plain HTTP, XOR-decoded and run in memory through node -i, so it never touches disk.
• Goal: The decoded logic steals cryptocurrency. Any wallet, browser extension or secret reachable from the infected Node process is at risk.

Indicators of Compromise

• C2 IPs: 103.179.143[.]219, 166.88.134[.]75, 23.27.13[.]72, 95.135.181[.]151
• Attacker Ethereum address: 0x1eef0849eda15d87f64e51c73c8442cf3c8bcef3
• Package versions listed above in package-lock.json, yarn.lock or pnpm-lock.yaml
• Node processes running with -i (interactive mode) on build agents or servers
• Outbound calls to public Ethereum RPC endpoints from applications that have no reason to use blockchain services

Detection

# Defensive: search lockfiles in a workspace for the affected package names
grep -rnE '"(@adminide-stack/|@cdmbase/wiki-browser|@pubngo-stack/help-browser|server-hemera-mongo|cdeops|react-contact-forms|tailwindcss?-(form-utils|contact-forms?)|tailwind-(form-core|input-kit|forms-kit))' \
  --include=package-lock.json --include=yarn.lock --include=pnpm-lock.yaml .

# Look for the loader pattern in installed modules
grep -rl "eval(atob(" node_modules --include=index.js 2>/dev/null

On endpoints and CI runners, alert on node -i started by a non-interactive parent, and on egress to the listed IPs.

Recommended Actions

• If any listed version was installed, do not stop at downgrading. Assume the code ran: rebuild the affected machines or containers, and rotate npm tokens, Git credentials, cloud keys and CI secrets that were reachable from them.
• Move cryptocurrency held in wallets that were present on affected machines to new wallets created on a clean device.
• Pin dependencies with lockfiles and integrity hashes, and consider a minimum package age policy (for example, rejecting versions published in the last 48–72 hours).
• Install with --ignore-scripts in CI where you can, and limit outbound network access from build agents.
• Maintainers should enable 2FA for publishing and use granular, short-lived npm tokens or trusted publishing.

Analyst Assessment

The download count is small, but the techniques are the important part. Account hijacking, blockchain-based C2 that cannot simply be taken down, and fileless execution are becoming standard in npm malware. Because the C2 address can change without a new package release, any affected install that is still running remains controllable by the attacker. Teams that consume small UI and form packages without a review gate are the most exposed. We rate the threat Medium.