MEDIUMSupply Chain
Global

Hijacked npm Package Attempts to Deliver PolinRider-Linked RAT

·Source: Sonatype (Maven/npm)

Updated:

Executive Summary

<img src="https://www.sonatype.com/hubfs/blog_npm_hijack2.jpg" alt="Image with large text at center "npm package hijack" and the Sonatype company name above it." class="hs-featured-image" style="width:auto !important

Analysis

Attackers do not need to wait fo r a CVE whe n they can publish directly into the build.

Indicators of Compromise (4)

URL (3)
https://www.sonatype.com/blog/hijacked-npm-package-attempts-to-deliver-polinrider-linked-rat
VirusTotalURLhaus
https://www.sonatype.com/hubfs/blog_npm_hijack2.jpg
VirusTotalURLhaus
https://www.sonatype.com/security-advisories
VirusTotalURLhaus
Domain (1)
www.sonatype.com
VirusTotalURLhaus
Source Attribution

Originally published by Sonatype (Maven/npm) on May 21, 2026.

Related Threats

MEDIUMSupply Chain

Malicious Sicoob NuGet Steals Banking Credentials as npm Packages Target Cloud Secrets

Cybersecurity researchers have discovered a malicious NuGet package that masquerades as a C# software development kit for Sicoob, one of Brazil's largest cooperative financial systems, to siphon client IDs and PFX certificates. According to Socket, versions 2.0.0 through 2.0.4 of "Sicoob.Sdk" contain functionality to exfiltrate sensitive information, including PFX certificates that are used to

The Hacker News
CRITICALSupply Chain

Cybersecurity trends in SEC filings

In 2023, the Securities and Exchange Commission (SEC) required public companies to include a new section in their 10-K annual filings that is devoted to cybersecurity. This section is meant to address “cybersecurity risk management, strategy, governance and incidents.” I got curious as to what senior cybersecurity executives are conveying about their companies in these reports. I turned this into

CSO Online
MEDIUMSupply Chain

AI-Generated npm Malware Leaks Its Own GitHub Token

Sloppy AI-generated npm infostealer leaked its own GitHub token, exposing the operator

Infosecurity Magazine