PolinRider compromised legitimate npm packages and embedded a loader that retrieves command-and-control infrastructure from data encoded in an Ethereum transaction. The loader decodes obfuscated JavaScript, downloads an XOR-obfuscated payload over HTTP, and executes it through an interactive Node.js process in memory. Seventeen packages representing roughly 1,400 weekly downloads were affected, although the download count does not indicate confirmed infections. The source links the campaign to PolinRider but does not independently state its broader DPRK association.