BLOG

Earliest Known PolinRider Malware Found in 2025 npm Packages

A hijacked maintainer account shipped the North Korean payload 8 months before the first documented victims.

By c0a15726-c5b1-4b0d-85e6-fe15553df9e2, cb482791-4ef1-4762-96ad-b0ca4bdd538e · 2026-10-30T06:50:00.000Z

itsa-utils hadn’t published a new version since August 2018. Then, at 20:15 UTC on Sunday, May 4, 2025, an attacker published version 1.4.2 on npm. Over the next 90 minutes, versions of eight more npm packages from the same maintainer followed. Every version we could recover contains a malicious payload with a RAT and an infostealer.

This story isn’t new. Account takeovers have become increasingly common. But when we analyzed these packages, we were in for a big surprise. The malware was obfuscated JavaScript appended to the end of existing JavaScript files and hidden by hundreds of whitespace characters. That pattern looked a lot like the PolinRider campaign, which had no documented victims before January 2026. Like an insect trapped in amber, we wanted to study it and see what we could learn.

What we found is a building block. The payload, the blockchain delivery chain, and the habit of appending code to a config file are all PolinRider components. The self-spreading behavior that defines the campaign in 2026 isn’t in the 2025 evidence.

TL;DR

What we found: A PolinRider attack from May 2025, eight months before the earliest documented victims. The 2025 sample carries PolinRider’s payload but not its documented spread behavior, which appears in the same maintainer’s GitHub repositories in four windows between January and July 2026. The blockchain records behind it date attacker activity back to February 2025.
How it hit: Nine npm versions from one maintainer, published in 90 minutes on May 4, 2025. We confirmed the payload in four of them.
The proof: The same payload pattern, marker, XOR key, command server and server paths that OpenSourceMalware has documented for PolinRider.
The payload: JADESNOW, an INVISIBLEFERRET bootstrapper, a Socket.IO RAT, and a Python credential stealer, delivered through BNB Smart Chain and Ethereum transactions.
Impact: Remote command execution, plus theft from browsers, wallets, Git, GitHub, password managers, and cloud storage, on Windows, Linux, and macOS.

The proof that this is PolinRider

Eight of nine traits tie this sample to PolinRider as OpenSourceMalware has documented it. The ninth, spread by force-push, appears only in 2026. That makes the 2025 sample a building block of PolinRider, much like TasksJacker. The shared XOR key and the shared command server are the strongest links.

OpenSourceMalware folded TasksJacker into PolinRider because it shared the propagation script, blockchain addresses, and decryption keys. This sample shares a decryption key, the command server, and the server paths. It does not show the propagation script.

Trait

PolinRider as documented

This sample, May 2025

Payload appended after whitespace

Obfuscated JavaScript appended to existing files, pushed off screen by runs of whitespace

The same, in index.js and webpack.config.js, after 1,012 or 253 whitespace characters

Marker string

global['_V'] and global['!']

global['_V']='5-itsa'

XOR key

ThZG+0jfXE6VAGOJ

The same key decrypts the JADESNOW stage

Blockchain dead drop

TRON first, with Aptos and BNB Smart Chain as fallbacks

BNB Smart Chain, then Ethereum calldata

Command server

154.91.0.103

The bootstrapper’s server

Server paths

/verify-human/{channel}, /u/f, /d/python.zip, /d/python.7z, /d/7zr.exe

All five appear in the chain

Payload family

BeaverTail loader and InvisibleFerret backdoor

INVISIBLEFERRET bootstrapper, Socket.IO RAT, Python stealer

Exfiltration

Some payloads send data through a Telegram bot

The stealer sends data through a Telegram bot

Spread by force-push

A script folds the change into an existing commit and force-pushes it as the developer, with backdated commits

Not seen in the 2025 packages. The same maintainer’s repositories show it from January 2026 (variants B, B2, and C).

What’s unique in this sample:

A different wallet. The BNB Smart Chain wallet 0x9BC1355344B54DEDf3E44296916eD15653844509.
Three different keys. $v$5;kmc$ldm*5SA, hk7#cH%v806Q/GH!, and 9KyASt+7D0mjPHFY.
A marker format. The values 5-itsa, 5-55, and 5-1-55 share a shape with build markers such as 9-10094. We think they’re campaign IDs.
An older chain design. There’s no TRON or Aptos.

Decoding the chain

As an example, we’ll walk through how the malware works in itsa-utils@1.4.2.

The package has no install hooks. The trigger is the entry point: the first 11 lines of index.js export the utility functions, and line 12 holds a heavily obfuscated program that runs when an application imports the package. Apart from that line, the file is identical to the clean 1.4.3.

The chain uses EtherHiding, which stores executable content in the calldata of blockchain transactions. The loader reads the transactions through public explorer APIs, but the encrypted stages stay on-chain. Google Threat Intelligence documented the same BNB Smart Chain contract, owner wallet, and transaction lineage in UNC5342’s use of JADESNOW to deliver INVISIBLEFERRET.
Stage 1 loader

What it shows: the malware depends on blockchain data it never has to host.

The package sets two globals, then enters layers of generated functions and shuffled strings:

global['_V'] = '5-itsa';
global['r'] = require;

_V is a campaign marker passed to every later stage. It ends up in command server paths and victim messages.

After deobfuscation, the loader asks Binplorer for the latest mint operation on the attacker wallet, takes operations[0].transactionHash, and queries /getTxInfo/<hash>. It then processes the transaction’s input value in this order: remove 0x, hex decode to UTF-8, split on .., Base64 decode the second part, XOR with $v$5;kmc$ldm*5SA, and run the result with node -e, with global['_V'] prepended. On non-Windows systems the child process is detached with its streams ignored. Errors are discarded.

Binplorer no longer accepts type=mint on getAddressHistory, so the loader’s exact request fails today. The transaction and payload remain. We recovered the calldata through public RPC queries.

Stage 2 JADESNOW

What it shows: the February 7, 2025 date. This stage sits in block 46456153 on BNB Smart Chain, timestamped 2025-02-07 17:37:33 UTC.

The transaction input holds a Base64 string between two .. delimiters. Decoding it and XORing with the key recovers JADESNOW, a second obfuscated loader. It switches to Ethereum and reads one transaction through three explorers for redundancy: Ethplorer, BlockCypher, and Blockchair. It hex-decodes the calldata, XORs it with ThZG+0jfXE6VAGOJ, and passes the result to eval.

Stage 3 bootstrapper

What it shows: the link to the documented campaign. The server and paths here match OpenSourceMalware’s lists.

The Ethereum transaction is in block 21795760, timestamped 2025-02-07 16:15:11 UTC, sent from the attacker wallet to 0x000000000000000000000000000000000000dEaD. The decrypted bootstrapper sets up its server at 154.91.0.103:27017. Before it continues, it queries ip-api.com. If the country code is RU, it reports Blocked! and exits. Otherwise it installs missing Node dependencies and tries to make Python 3.12.7 available, downloading support files from /d/python.zip, /d/python.7z, /d/7zr.exe, and /d/pyenv.zip. It reports status to POST /verify-human/5-itsa. Then it fetches two more payloads from Ethereum.

Stage 4A Node.js RAT

What it shows: interactive access, not just theft.

The RAT connects to a Socket.IO server at 85.239.62.36:3306, a port usually used by MySQL. It identifies the victim by hostname, username, operating system, and a random process UUID, then waits for operator commands. It supports shell commands, changing directory, uploading a file or a whole directory, stopping an upload, resetting its directory, and terminating itself. Uploads go to 85.239.60.213:27017/u/f. Commands run with shell: true, and on Windows the attacker’s portable Python is added to PATH.

Stage 4B Python stealer

What it shows: the theft is broad and covers developer credentials.

The transaction produces a small Python wrapper. Reversing its Base64 value and decompressing the zlib stream gives a 65,500-byte credential stealer. It works on Windows, Linux, and macOS, installs missing libraries, sets a single-instance lock, and collects host identifiers.

Browsers. It targets Chrome, Chromium, Opera, Opera GX, Brave, Edge, Arc, Vivaldi, and Firefox. It recovers encryption material through Windows DPAPI, the macOS Keychain, Linux Secret Service, or KDE Wallet, then exports passwords, cookies, cards, profiles, extension storage, and Firefox NSS credentials. It also enumerates Windows Credential Manager and Linux Secret Service entries.

Wallets and developer data. It targets more than 80 browser extensions, including MetaMask, Phantom, Coinbase, Binance, Trust Wallet, TronLink, OKX, Ronin, Keplr, Rabby, Exodus, and SafePal. It also collects Git credentials, GitHub CLI tokens, Solana key files, 1Password and Dashlane data, Exodus and Atomic wallets, Electrum, Bitcoin and Dogecoin wallets, macOS login keychains, and WinAuth and Proxifier profiles. Cloud storage discovery covers Dropbox, Google Drive, OneDrive, iCloud, Box, MEGA, and pCloud. On Linux it also checks mounted Windows volumes under /mnt.

Exfiltration. Loot is staged in %USERPROFILE%\.npm on Windows or /tmp/.npm elsewhere, packed into AES-encrypted ZIPs with the password ,./,./,./, and sent to 85.239.62.36:27017/u/f. Telegram is the fallback for archives under 50 MB. After a successful upload, the stealer deletes the archives and staging directories.

The Telegram bot and persistence

The stealer contains a Telegram bot token and a hardcoded chat ID. The token was still valid when we checked in October 2026.

Field

Value

Bot ID

7870147428

Username

@file_1018_bot

Name

File Bot

Can join groups

Yes

Can read all group messages

Webhook

None

Pending updates

Destination chat ID

-4697384025

The bot is send-only. The malware calls sendDocument and has no getUpdates, getFile, or command handling. Telegram’s API doesn’t expose the bot’s past messages, so we retrieved no victim archives. An active token proves only that the credential worked when we tested it. We’ve redacted it here, and the bot and chat should be reported to Telegram.

None of the stages creates a run key, scheduled task, launch agent, or service, so nothing survives a reboot. The malware lasts through detached Node.js processes, hidden Windows process creation, ignored streams, Socket.IO reconnects every five seconds, a portable Python install, runtime installation of dependencies, silent error handling, and a Russia kill switch.

The attack in nine packages

The maintainer has 59 packages on npm. On May 4, 2025, nine of them got a new version within 90 minutes. itsa-utils was first.

Published (UTC)

Package and version

Where the payload sits

Status now