PolinRider compromised development branches of the Packagist package `visanduma/nova-two-factor` by hiding an executable loader inside `tailwind.config.js`. The loader derives rotating C2 addresses from Ethereum transaction recipient fields, then downloads Node.js and Python components over plaintext HTTP. Its final cross-platform stealer targets browser sessions, cryptocurrency wallets, password managers, operating-system credential stores, and developer credentials such as GitHub tokens and environment variables. SlowMist reconstructed the complete delivery chain but found no victim evidence confirming successful theft.