{
  "campaign": {
    "name": "PolinRider",
    "slug": "polinrider",
    "href": "/ti/campaigns/polinrider",
    "description": "Blockchain-based C2 loader campaign that injects payload code into production JS bundles of legitimate npm packages. Uses a three-layer blockchain dead-drop resolver: Tron smart contract stores encrypted C2 URL, BSC transaction carries XOR-encrypted payload, Aptos used for additional staging. Payload executes at require/import time as a side-effect, not via install hooks. Shared infrastructure across multiple compromised packages including astro.config.mjs and @joyfill scope.",
    "objective": "Deliver arbitrary JavaScript payloads via blockchain-resolved C2 to downstream consumers of compromised npm packages.",
    "aliases": [],
    "discovered_at": "2026-07-28"
  },
  "packages": [
    {
      "ecosystem": "npm",
      "name": "@joyfill/layouts",
      "href": "/ti/packages/npm/@joyfill/layouts",
      "threat_types": [
        "c2_agent",
        "persistence"
      ],
      "versions": [
        "0.1.2-2773.beta.0"
      ]
    },
    {
      "ecosystem": "npm",
      "name": "@joyfill/components",
      "href": "/ti/packages/npm/@joyfill/components",
      "threat_types": [
        "c2_agent"
      ],
      "versions": [
        "4.0.0-rc24-2773-beta.4"
      ]
    }
  ],
  "indicators": [
    {
      "kind": "wallet",
      "value": "TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP",
      "href": "/ti/ioc/wallet/TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP",
      "context": "Primary Tron C2 address for PolinRider campaign. Stores encrypted C2 URL in smart contract data. Shared across @joyfill/layouts and astro.config.mjs attacks."
    },
    {
      "kind": "wallet",
      "value": "TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG",
      "href": "/ti/ioc/wallet/TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG",
      "context": "Fallback Tron C2 address for PolinRider campaign. Used when primary address TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP is unavailable."
    },
    {
      "kind": "wallet",
      "value": "0x9bc1355344b54dedf3e44296916ed15653844509",
      "href": "/ti/ioc/wallet/0x9bc1355344b54dedf3e44296916ed15653844509",
      "context": "BSC (Binance Smart Chain) attacker wallet for PolinRider campaign. Transaction data from this wallet carries XOR-encrypted JavaScript payload."
    },
    {
      "kind": "wallet",
      "value": "TA48dct6rFW8BXsiLAtjFaVFoSuryMjD3v",
      "href": "/ti/ioc/wallet/TA48dct6rFW8BXsiLAtjFaVFoSuryMjD3v",
      "context": "Stage 2 Tron C2 address for PolinRider campaign. Second blockchain fetch uses this address after campaign routing selects HTTP C2 server."
    },
    {
      "kind": "ipv4",
      "value": "166.88.134.62",
      "href": "/ti/ioc/ipv4/166.88.134.62",
      "context": "HTTP C2 server for PolinRider campaign, selected when campaign marker starts with 'A' (joyfill incident). Set by stage 2 campaign routing."
    }
  ],
  "ttps": [
    {
      "name": "Compromise Software Supply Chain",
      "mitre_attack_id": "T1195.002",
      "href": "/ti/ttps/T1195.002"
    },
    {
      "name": "Command and Scripting Interpreter: JavaScript",
      "mitre_attack_id": "T1059.007",
      "href": "/ti/ttps/T1059.007"
    },
    {
      "name": "Obfuscated Files or Information",
      "mitre_attack_id": "T1027",
      "href": "/ti/ttps/T1027"
    },
    {
      "name": "Web Service",
      "mitre_attack_id": "T1102",
      "href": "/ti/ttps/T1102"
    }
  ],
  "related_campaigns": [],
  "reports": [
    {
      "title": "Joyfill npm Packages Compromised with PolinRider Blockchain C2 Loader",
      "url": "https://safedep.io/joyfill-npm-blockchain-c2-supply-chain",
      "published_at": "2026-07-29"
    }
  ]
}