Compromised npm packages can point to a new malware server without receiving another package update. In a November 4 report, OX Security describes a PolinRider-linked campaign using Ethereum transactions to hold the address that an injected loader needs.
According to the researchers, importing an affected package triggers the loader. It queries public Ethereum RPC services, resolves an encoded server address, then retrieves and executes an obfuscated JavaScript payload over HTTP. Ethereum provides a lookup reference; the report does not describe the downloaded payload itself being hosted on the blockchain.
OX lists 17 affected packages, with examples including cdeops 13.5.31 and server-hemera-mongo 0.0.15 and 0.0.16. Its table marks the releases as taken down and supplies no fixed-version numbers. The approximately 1,400 combined weekly downloads describe package activity, not a confirmed victim count.
The report distinguishes installation from execution. If an affected package was loaded and its malicious code ran, OX advises treating accessible cryptocurrency wallets and related credentials as potentially compromised.
Separate dependency exposure from execution
The first review should establish which dependency tree reached a workstation or build environment. npm documents that its lockfile records the exact generated tree, making it useful for comparing a project against the researcher’s affected-version table. A familiar package name is insufficient: the version and the resolved tree matter.
For repeatable builds, npm’s documentation explains that npm ci uses an existing lockfile and fails on a mismatch with the package manifest. This supports consistency, but consistency alone cannot establish that a locked dependency is trustworthy.
Teams investigating a match should preserve dependency and build records before changing the environment, then examine whether the package was imported and what processes or outbound connections followed. Replacing a dependency may stop future exposure; it cannot establish what already executed or which accessible secrets need a separate recovery decision.
