Sonatype found Ethereum-based runtime loaders in 12 releases of 10 hijacked npm packages, with execution occurring during module loading or application startup rather than through install hooks. The loaders resolve payload infrastructure through a hard-coded Ethereum wallet, fetch XOR-encoded JavaScript from `/0x/cls` and `/0x/ls`, and execute it in the application or detached Node.js processes. An exact wallet match, identical retrieval paths, and overlapping C2 infrastructure link the releases to previously documented PolinRider activity, although the report does not explicitly attribute the operation to North Korea or establish that PolinRider and GhostAction share an operator.