PolinRider loaders spread through hijacked npm packages
Sonatype Research Labs found 10 npm packages with hidden malware loaders that used the Ethereum blockchain to locate a server and fetch more code. The finding was confirmed on November 4, 2026, and Sonatype tracks it as sonatype-2026-010515 with a severity score of 8.7. How the hijacked packages were altered The compromised packages served different purposes. Some were tied to Redux, health APIs, browser activity tracking, utilities and server examples.…