A compromised npm maintainer account published nine PolinRider-linked package versions on May 4, 2025, predating the campaign's previously documented victims by eight months. Recovered packages used blockchain transactions to deliver JADESNOW, an INVISIBLEFERRET bootstrapper, a Socket.IO RAT, and a cross-platform credential stealer. Shared decryption material, command infrastructure, and server paths tie the samples to the North Korean PolinRider cluster, although the 2025 payload lacked the campaign's later automated force-push propagation. The same maintainer's GitHub repositories were repeatedly infected through history-rewriting force-pushes in 2026.