[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-fUn_w4XEQPMcV21NkTP2LfuTonMVtcQMpVV5bchy7E":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":54},"ca482d88-9612-4f43-82f0-9be5642070d3","hijacked-npm-packages-use-ethereum-blockchain-to-hide-c2-servers","26833a5a-568d-4b4e-b2c9-8e2e0a4aee45","Hijacked npm Packages Use Ethereum Blockchain to Hide C2 Servers","Attackers compromised 10 legitimate npm packages and injected obfuscated malware (PolinRider) that queries Ethereum blockchain transactions to dynamically retrieve command-and-control server IP addresses — a novel technique that evades traditional signature-based and install-hook detection. This supply chain attack is particularly dangerous because developers unknowingly pull malicious code into their build pipelines when updating or installing packages they already trust. The use of blockchain as a decentralized C2 lookup mechanism makes it extremely difficult to block or take down the infrastructure through conventional domain\u002FIP blocking. Without continuous dependency scanning and package integrity verification, organisations may not discover the compromise until malware has already executed and exfiltrated data.","**Immediate actions:**\n- Audit all projects for the 10 compromised npm packages and roll back to verified clean versions immediately.\n- Run software composition analysis (SCA) scans across all codebases to detect the injected obfuscated code or known PolinRider signatures.\n\n**Long-term improvements:**\n- Enforce a private npm registry or artifact proxy (e.g., Nexus, Artifactory) with allow-listing so only vetted package versions enter the build pipeline.\n- Pin all third-party dependencies to cryptographically verified, exact version hashes (lockfiles + subresource integrity) to prevent silent version substitution.\n- Implement a formal software supply chain security policy that includes provenance verification (e.g., SLSA framework, Sigstore) for every open-source dependency.\n\n**Detection measures:**\n- Deploy runtime behavioural monitoring to alert on unexpected outbound connections to blockchain RPC endpoints or unusual HTTP payload downloads from within build\u002FCI environments.\n- Integrate continuous dependency scanning into CI\u002FCD pipelines so malicious or newly flagged package versions are blocked before deployment.",[12,13,14,15,16,17,18],"CIS Control 7: Continuous Vulnerability Management","OWASP A06:2021 Vulnerable and Outdated Components","NIST SP 800-53 SI-2: Flaw Remediation","MITRE ATT&CK T1566: Phishing","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":20,"MITRE ATT&CK T1566: Phishing":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"CIS Control 17: Incident Response Management":23,"OWASP A06:2021 Vulnerable and Outdated Components":24,"CIS Control 7: Continuous Vulnerability Management":25,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":26},"NIS2 requires essential and important entities to implement supply chain security measures covering relationships with direct suppliers; the hijacked npm packages exploit exactly the trust relationship with third-party software suppliers that this article mandates be managed and secured.","While not phishing in the traditional sense, the GhostAction campaign's use of seemingly legitimate package updates as a delivery vector mirrors the trust-abuse principle ATT&CK documents; the broader supply-chain technique (T1195.001: Compromise Software Dependencies) is closely related and highlights the need for dependency integrity controls.","SI-2 requires organisations to identify, report, and correct information system flaws, including vulnerabilities in third-party software components like npm packages, within defined timeframes — a process that would have triggered rapid patch\u002Frollback here.","Detecting and containing PolinRider across multiple projects requires a practised incident response plan that includes procedures for compromised dependencies — without it, teams lack the playbooks to quickly isolate affected builds and assess the blast radius of the GhostAction campaign.","This attack is a textbook A06 scenario — malicious code was injected into trusted open-source components; OWASP's guidance on verifying package integrity and using SCA tools directly addresses how to prevent such supply chain poisoning.","Continuous scanning of third-party dependencies would have flagged the 10 compromised npm packages shortly after Sonatype's November 4 disclosure, enabling rapid removal before the malware executed in production pipelines.","A.8.8 mandates timely identification and remediation of technical vulnerabilities in software used by the organisation, which would require tracking open-source package advisories and acting on the CVE sonatype-2026-010515 (severity 8.7) promptly.","published","2026-11-09T13:21:04.2292+00:00","2026-11-09T13:21:04.193+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fcybersecuritynews.com\u002Fhackers-hijack-10-npm-packages-to-spread-polinrider-malware-using-ethereum-blockchain\u002F","hackers-hijack-10-npm-packages-to-spread-polinrider-malware-using-ethereum-block-51d343","Hackers Hijack 10 npm Packages to Spread PolinRider Malware Using Ethereum Blockchain",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":42,"name":43,"slug":44,"description":45,"color":46},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[48],{"id":49,"date":50,"edition":51,"title":52,"audio_url":53},"0398d484-c6ca-4621-9fc0-20e41905e3ef","2026-11-09","afternoon","ThreatNoir Afternoon Brief — November 9","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-11-09\u002Fthreatnoir-afternoon-brief-2026-11-09.mp3",[55,58,62],{"slug":38,"name":56,"problem":57},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":59,"name":60,"problem":61},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":63,"name":64,"problem":65},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]