A software dependency can become an entry point for concealed malicious code, even without a consumer install or postinstall hook. In this case, Sonatype Research Labs observed loaders linked to previously documented PolinRider activity based on a shared Ethereum wallet, retrieval paths, and payload-server infrastructure.

This concealed code can run when an affected entrypoint loads, or when a server-hemera-mongo application starts, and it uses Ethereum transaction data to locate remote JavaScript. The operator can change that remote JavaScript without publishing another npm release, so dependency inventories need to be paired with runtime and network investigation.