Hijacked npm Packages Use Ethereum Blockchain to Hide C2 Servers
Written by AI from the linked story. Not reviewed by an editor. How this works
Attackers compromised 10 legitimate npm packages and injected obfuscated malware (PolinRider) that queries Ethereum blockchain transactions to dynamically retrieve command-and-control server IP addresses — a novel technique that evades traditional signature-based and install-hook detection. This supply chain attack is particularly dangerous because developers unknowingly pull malicious code into their build pipelines when updating or installing packages they already trust. The use of blockchain as a decentralized C2 lookup mechanism makes it extremely difficult to block or take down the infrastructure through conventional domain/IP blocking. Without continuous dependency scanning and package integrity verification, organisations may not discover the compromise until malware has already executed and exfiltrated data.
Tactical Insight
Immediate actions
- Audit all projects for the 10 compromised npm packages and roll back to verified clean versions immediately.
- Run software composition analysis (SCA) scans across all codebases to detect the injected obfuscated code or known PolinRider signatures.
Long-term improvements
- Enforce a private npm registry or artifact proxy (e.g., Nexus, Artifactory) with allow-listing so only vetted package versions enter the build pipeline.
- Pin all third-party dependencies to cryptographically verified, exact version hashes (lockfiles + subresource integrity) to prevent silent version substitution.
- Implement a formal software supply chain security policy that includes provenance verification (e.g., SLSA framework, Sigstore) for every open-source dependency.
Detection measures
- Deploy runtime behavioural monitoring to alert on unexpected outbound connections to blockchain RPC endpoints or unusual HTTP payload downloads from within build/CI environments.
- Integrate continuous dependency scanning into CI/CD pipelines so malicious or newly flagged package versions are blocked before deployment.