SlowMist linked malicious development branches of the Packagist package visanduma/nova-two-factor to PolinRider and found a loader concealed after 507 spaces in tailwind.config.js. Laravel Mix execution queries Ethereum transactions to derive rotating C2 IP addresses, retrieves Node.js and Python stages, and ultimately deploys a cross-platform credential stealer. The payload targets browser credentials and cookies, cryptocurrency wallets, password managers, development tokens, and operating-system credential stores on Windows, macOS, and Linux. SlowMist recovered the remote payloads for static analysis but states it has no victim-side evidence confirming successful theft.