SafeDep confirmed PolinRider loaders in 35 GitHub repositories, where frequently executed build and test scripts resolved rotating C2 addresses from Ethereum transactions. Two operator wallets exposed 11 servers, and related infrastructure delivered Node.js and Python stages that stole environment secrets, browser credentials, cookies, Git credentials, and wallet-extension data. The loader used detached processes, sandbox checks, forged commit metadata, and a WSL2-to-Windows execution path. A second branch shared infrastructure with earlier SafeDep investigations and appeared in 70 malicious npm and PyPI records tracked by OpenSSF.