The most dangerous code your application runs this week may have arrived through a door you held open yourself. On November 4, 2026, Sonatype Research Labs confirmed that attackers had hijacked ten popular npm packages and slipped hidden code into twelve separate releases, seeding a malware family now tracked as PolinRider under the identifier sonatype-2026-010515 and rated high severity. What makes the campaign notable is not the intrusion but the hiding place: the malicious code locates its command-and-control infrastructure by consulting the Ethereum blockchain, a ledger no registrar, hosting provider, or takedown operation can scrub.
That single detail deserves every security team’s attention. It removes the last structural weak point of commodity malware – the killable command-and-control server – and it arrives in a week when BlackBeam’s Internet Intelligence Platform recorded 734 attack incidents, with trust-abuse categories climbing across the board. For development teams and security operations centers alike, the message is uncomfortable: modern attacks do not break through the perimeter. They authenticate through it.
Inside the PolinRider Campaign
The mechanics follow a pattern that has become wearily familiar to anyone responsible for software supply chain security. Attackers took control of ten npm packages and used that control to publish twelve poisoned releases. Any project that pulled one of those versions during the exposure window, whether as a direct dependency or buried several layers deep in a transitive tree, received the PolinRider loader alongside its legitimate code.
Sonatype confirmed the finding on November 4, 2026, tracking it as sonatype-2026-010515 with a high severity score. The payload’s distinguishing behavior is its two-stage design: the hidden code first resolves its command-and-control server using data published to the Ethereum blockchain, then reaches out to that server to download and execute additional malware. The blockchain functions as an address book that is publicly readable, globally replicated, and permanent.
npm remains an irresistible target for this kind of operation because of scale and reach. The registry serves millions of packages, and JavaScript dependency trees are famously deep – a single modern web application can transitively depend on over a thousand of them. Very few engineering teams can name every package their build actually executes, and the gap between what a project depends on and what its developers are aware of is precisely the blind spot package-hijack campaigns are engineered to exploit. A poisoning operation does not need to beat your defenses; it only needs to wait for your next build.
Why Blockchain Command-and-Control Changes the Hunt
Traditional commodity malware carries a structural weakness that defenders have learned to press hard. It phones home to an address the attacker controls – a domain, an IP address, a hardcoded endpoint – and once researchers identify that address, it can be blocklisted, sinkholed, or seized. Entire botnets have been dismantled by removing a handful of endpoints.
PolinRider’s loader undermines that playbook. By resolving its server through data written to the Ethereum blockchain, the campaign turns an immutable public ledger into its address book. Command-and-control endpoints can be rotated by publishing new on-chain data, and there is no registrar to appeal to, no hosting provider to notify, and no single point of failure that a seizure can remove. The infrastructure is not hidden so much as it is un-removable.
For defenders, this shifts detection from indicator-matching to behavior. A build server, CI runner, or production web application that suddenly queries public Ethereum RPC endpoints has almost no innocent explanation. That behavioral signature – blockchain lookups from infrastructure with no Web3 function – is far more durable than any list of indicators of compromise, and it is the kind of alert a monitoring team can put into production today.
The Week in Numbers: Trust Abuse on the Rise
PolinRider did not appear in a vacuum. BlackBeam’s collection recorded 734 attack incidents over the past seven days, and the category distribution shows why anyone tracking cybersecurity trends keeps returning to the same theme: attackers are increasingly routing through things their victims already trust.
Ransomware remained the single largest category at 317 incidents, roughly 43 percent of everything tracked. Command Injection logged 63 incidents, Malware 45, Data Breach 30, and Phishing 18. Supply Chain Attacks accounted for 16 incidents and Zero-Day Exploits for 10. Individually those last two are small numbers next to ransomware’s total, but they carry an outsized blast radius: one poisoned package or one exploitable flaw cascades into thousands of downstream victims. PolinRider alone potentially reached every project that installed the twelve poisoned releases during the exposure window. A further 219 records carried no disclosed attack type – initial reports and victim statements frequently omit technical detail in the first days after an incident, which means even a 734-incident week understates the true picture.
The sector data completes the story. Finance led all targeted sectors with 90 incidents, followed by Retail at 59, Healthcare at 58, Manufacturing at 42, and Government at 40. The United States was the most frequently cited victim geography at 130 incidents, nearly seven times the next country on the list. Among the week’s government-adjacent stories: Italian Prime Minister Giorgia Meloni publicly blamed pro-Russian hackers for leaking Foreign Minister Antonio Tajani’s personal data on the dark web – a reminder that politically motivated leaks remain aimed at institutions as well as enterprises.
Exploited Infrastructure Grabbing Headlines This Week
Three other stories from the week’s collection merit a place on every defender’s shortlist, because all three extend the same theme of trust and exposure.
OpenSSH under active exploitation. Attackers are exploiting an authentication bypass in OpenSSH that researchers have dubbed SSHole, with the first waves attributed to botnets and cryptocurrency miners. That attribution matters: botnets and miners are the customary early adopters of any mass-exploitable flaw, and their presence is usually the overture before more deliberate actors – including ransomware operations – fold the flaw into their playbooks. If your SSH footprint is internet-facing, treat this as a race.
SonicWall lands on CISA’s exploited-vulnerability catalog. CISA added CVE-2026-19868, a SonicOS SSLVPN vulnerability, to its Known Exploited Vulnerabilities catalog on November 6, 2026. The flaw lets an attacker holding valid credentials bypass SAML authentication controls and potentially evade multi-factor authentication. The scenario deserves emphasis: a stolen credential set using your own VPN to defeat your MFA. Multi-factor authentication has been the load-bearing wall of remote access security for a decade, and vulnerabilities like this one are the reason it can never be the entire wall.
Industrial refrigeration controllers in scope. CISA, the FBI, HHS, USDA, and the Department of Transportation published a joint advisory on attacks against industrial refrigeration controllers – the equipment behind cold-chain logistics, pharmaceutical storage, and food processing. The agencies’ guidance is strikingly blunt: the fixes are basic, and most start with getting the devices off the internet. Every controller reachable through a routine scan is a facility that can be disrupted from anywhere in the world.
What BlackBeam Is Seeing
Platform data from the same seven-day window shows actor-level momentum that the news cycle will take weeks to absorb. BlackBeam’s correlation engine tracked a 1,100 percent week-over-week surge in attacks attributed to the n0n ransomware operation – from 10 incidents the previous week to 120 this week. Of those, 109 were ransomware incidents concentrated in Retail (31) and Healthcare (21). Our extensive threat actor database profiles the n0n operation as Eastern Europe-based, financially motivated, and carrying a high threat level.
n0n was not the only name accelerating. Akira posted a 250 percent jump, from 6 to 21 attacks, with a tight focus on Finance (10 incidents) and Healthcare (5) – the two sectors where extortion leverage is highest – and at least one supply chain operation in the mix. A newer entry in our tracking, the Argentina-linked soul ransomware operation, appeared for the first time this week with 25 attacks, 24 of them ransomware, spread across Healthcare (8) and Manufacturing (6). When three separate operations surge simultaneously into the same few sectors, that is not noise; that is a targeting pattern.
Underneath the actor activity, BlackBeam processed 651,877 wildcard-domain correlations over the past seven days – newly observed lookalike and permutation domains matched against tracked client brands. That is the quiet half of modern cyber threat intelligence: not the dramatic breach headline, but the industrial-scale registration of deceptive domains that precedes phishing, brand abuse, and credential harvesting. Most organizations have no systematic way to notice when a domain mimicking theirs appears in the wild. Closing that gap is exactly the work our platform exists to do.
Practical Steps for Organizations
- Lock your dependency chain. Pin versions with lockfiles, enforce integrity checks, and audit your dependency tree for packages you do not actually need. Every unnecessary package is attack surface that a supply chain actor can rent cheaply.
- Watch for anomalous releases. Sudden version jumps, a new maintainer on a long-dormant package, or releases pushed outside a project’s normal rhythm are the tell-tale signatures of package-hijack campaigns like PolinRider. Automated registry monitoring beats manual review, because a poisoned release may live for only hours before someone notices.
- Treat blockchain RPC egress as hostile until proven otherwise. Build hosts, CI runners, and production web servers rarely have a legitimate reason to query public Ethereum RPC endpoints. An alert on those connections closes the command-and-control channel this campaign depends on.
- Patch internet-facing authentication infrastructure on a clock, not a calendar. The SSHole exploitation and the SonicWall KEV entry share a theme: whatever terminates SSH or SSLVPN exposure is the front door, and it is being kicked. Vulnerabilities on the Known Exploited Vulnerabilities catalog should move to the top of every patch queue regardless of how routine they look.
- Inventory and isolate operational technology. The industrial refrigeration advisory is a template for an entire class of risk. Find every controller your business depends on, ask whether it needs internet reachability at all, and remove it from the internet if it does not.
- Correlate rather than collect. A domain, a hash, or an actor name in isolation is noise. Continuous monitoring that ties newly registered lookalike domains to your brand, your suppliers, and tracked threat actors is what turns that noise into early warning – and it is precisely the work our platform does for a living.
The Bottom Line
PolinRider, SSHole, and the SonicWall KEV entry are three different stories with one shared lesson: the modern attack path runs through trust – trusted packages, trusted maintainer accounts, trusted remote access. Defenders can no longer assume that authenticated traffic is legitimate traffic, that published software is safe software, or that multi-factor authentication ends the accountability chain. The organizations that absorb that lesson early are the ones that will weather the weeks when a 734-incident total looks like the quiet ones.
You can watch these correlations as they form – surging actors, lookalike domains, and IOC matches tied to tracked groups – in BlackBeam, our Internet Intelligence Platform. The analysis behind this week’s numbers is powered by iDNA, our threat intelligence engine. And if your organization is ready for a US-based Security Operations Center that treats the software supply chain as a front line, contact DefendEdge.
Leave a Reply