Hidden loaders found in 12 releases of 10 hijacked npm packages, Sonatype says

What happened

Sonatype's research team reports hidden runtime loaders in 12 npm releases spread over 10 packages it describes as hijacked. The packages do unrelated jobs, including Redux integration, health APIs, browser activity tracking, utilities and server examples. Sonatype tracks the finding as sonatype-2026-010515. GitHub's advisory database has separately listed @adminide-stack/yantra-help-browser 12.0.194, one of the releases Sonatype names, as malware with no patched version. GitHub's entry says any computer that has had the package installed or running should be considered fully compromised.

According to Sonatype, each loader looks up transactions sent by a fixed Ethereum wallet, turns them into server IP addresses, and then downloads, XOR-decodes and executes JavaScript. Because the wallet acts as a dead drop, the operator can steer the loader to a new server with one more transaction, so blocking a single server does not stop it. The served JavaScript can also change without any new npm release.

The packages declare no install or postinstall hooks; Sonatype says the code can start whenever an affected entrypoint loads, or when the server-hemera-mongo application boots. Sonatype notes that turning off npm install scripts does not protect against this. It ties the releases to earlier PolinRider activity through the shared wallet, but says this does not prove PolinRider and GhostAction have the same operator.

Timeline

1. 4 Nov 2026

   Sonatype confirms 12 affected releases across 10 hijacked npm packages.[1]

2. 4 Nov 2026

   GitHub publishes a malware advisory for @adminide-stack/yantra-help-browser.[2]

Who is affected

Any developer machine, CI worker, build host or deployed service where the affected package code ran.

How to check

1. Search direct and transitive dependencies, lockfiles, internal npm mirrors and build records for the listed versions.
2. Look for detached node -i processes started by another Node process with piped input, and plain HTTP requests on port 443 to /0x/cls or /0x/ls.
3. Sonatype warns that a lockfile entry does not prove the code ran, and an import error does not prove it did not.

What to do

1. Replace the affected versions and stop internal mirrors and caches from serving them.
2. If the code ran, treat the host as compromised and examine its processes, network activity and reachable credentials.
3. Rotate credentials that may have been exposed, including publishing tokens, repository access, cloud keys and CI secrets.
4. From a different computer, rotate the secrets and keys stored on any machine where @adminide-stack/yantra-help-browser was installed or running.