How a Compromised npm Package Used Ethereum to Fetch Its Next Stage
On November 3, 2026 attackers published runtime loaders in 12 releases across 10 hijacked npm packages. Some of the packages had gone years without an update. Sonatype Research Labs links the activity to PolinRider, a campaign known for hiding loaders in compromised GitHub repositories and now becoming more prominent on npm. This 90-second video explains what happened and what teams should check to do next to ensure they are not impacted.
How the Loader Works
The altered releases added the loader to a file the package already runs. It reads the latest transaction from an Ethereum wallet, decodes a server address, and fetches the next stage. The operator can change that address in a new transaction without publishing another package version. Teams must validate whether the affected code ran and what the host could access.
Explore Details of the Security Event on 
What Teams Should Do Next
1.
Search for Affected Versions
Trace dependencies to identify if affected versions are inside your environment.
2.
Remove and Replace Affected Versions
Remove affected releases from your dependencies and cached copies. Verify a replacement release is clean before using it.
3.
Determine If the Code Ran
Check whether a project or build loaded an affected package. The loader runs when its code is loaded, without needing an install script.
4.
Investigate Exposure and Protections
If it ran, treat the host as compromised. Look for unexpected Node processes and outbound traffic, identify credentials it could reach, and rotate them.
Learn More about the Campaign
Related Resources
Frequently Asked Questions
Is PolinRider associated with North Korea’s Lazarus Group?
Yes, the PolinRider campaign is an active malicious code campaign attributed to the North Korean state-sponsored Lazarus Group.
Who is the Lazarus Group?
The Lazarus Group is a North Korean state-sponsored Advanced Persistent Threat (APT) organization. The name is also used broadly for related North Korean cyber activity, so attribution to Lazarus does not always identify the specific people behind an attack. The Lazarus Group has been linked to cyberattacks involving espionage, disruption, and financial theft.
What is Ethereum?
Ethereum is a blockchain network that records transactions in a shared public ledger. In this incident, the malicious package checked Ethereum transaction data to find a server address, then used that address to retrieve more code.
How does Sonatype Firewall help in security events like PolinRider?
Sonatype Firewall helps stop malicious open source packages at intake. It checks incoming component requests against Sonatype’s security intelligence and organizational policies, blocking malicious packages like the hijacked npm packages as part of PolinRider from entering the repository.