Sonatype uncovers the PolinRider loader in 12 releases across 10 hijacked packages. See how the npm PolinRider loader uses Ethereum to fetch malware.

Related Posts:

• Trojanized Inno Setup Installers Deliver Proxyware and Compute Hijackers
• LuaJIT XLoader Infostealer Spreads via Fake Orders
• BITTER PapRAT Malware Targets South Asian Organizations

The post PolinRider Loader Hits 10 Hijacked npm Packages Using Ethereum Dead-Drop Resolver appeared first on Daily CyberSecurity.

1. Executive summary

Modern software is assembled, not written. A single application routinely draws on hundreds of third-party components, pulled in on demand and updated continuously as part of normal process. That convenience has quietly become a dependable initial-access route that bypasses traditional perimeter and endpoint defenses. Rather than breaching a hardened production perimeter, adversaries increasingly compromise the developer, the maintainer account, the build pipeline, or the package registry — and let trusted automation carry their code the rest of the way.