Indicators of Compromise
Every IOC SafeDep has linked to a malicious package or campaign — domains, IPs, emails, hashes, and crypto wallets.
Every IOC SafeDep has linked to a malicious package or campaign — domains, IPs, emails, hashes, and crypto wallets.
| value | context | campaigns | Copy |
|---|---|---|---|
| github repotechnext/100-template-list | Repository still carrying the PolinRider loader at HEAD on 2026-09-30 (Ethereum wallet 0x33ff3eda, marker 5-1460-du, 5 infected file(s) in the index, 208 stars, 168 forks). Owner is a probable victim; do not clone or build. Evidence: https://github.com/technext/100-template-list/blob/9c70c9b1409ec41f12929d1d9e6faed255663148/64%20gentelella/vendors/autosize/build.js | 1 | |
| github repoaboozaid/react-native-facerecognition | Repository still carrying the PolinRider loader at HEAD on 2026-09-30 (Ethereum wallet 0x33ff3eda, marker 5-2-228-du, 1 infected file(s) in the index, 217 stars, 76 forks). Owner is a probable victim; do not clone or build. Evidence: https://github.com/aboozaid/react-native-facerecognition/blob/3f49c10affd186eff4160993999940bf3d728bea/example/metro.config.js | 1 | |
| github repoefstathiosntonas/react-native-style-libraries-benchmark | Repository still carrying the PolinRider loader at HEAD on 2026-09-30 (Ethereum wallet 0x33ff3eda, marker 5-2-272-du, 1 infected file(s) in the index, 481 stars, 34 forks). Owner is a probable victim; do not clone or build. Evidence: https://github.com/efstathiosntonas/react-native-style-libraries-benchmark/blob/5d8216b8bcac3c42c71fad75a44426f59809ef35/tailwind.config.js | 1 | |
| github repoSFARPak/AliFullStack | Repository still carrying the PolinRider loader at HEAD on 2026-09-30 (Ethereum wallet 0x33ff3eda, marker 5-1169-du, 17 infected file(s) in the index, 82 stars, 21 forks). Owner is a probable victim; do not clone or build. Evidence: https://github.com/SFARPak/AliFullStack/blob/c34f5cfea36db008b7c3e29c0d451b60758a30f4/Roo-Code/src/esbuild.mjs | 1 | |
| github repoaliezzahn/event-timeline-roadmap | Repository still carrying the PolinRider loader at HEAD on 2026-09-30 (Ethereum wallet 0x33ff3eda, marker 5-4-44-du, 1 infected file(s) in the index, 90 stars, 20 forks). Owner is a probable victim; do not clone or build. Evidence: https://github.com/aliezzahn/event-timeline-roadmap/blob/ac6232d87ed046450eb04071fda5f150c899a28a/postcss.config.mjs | 1 | |
| github repogumlau/nextjs-seo-blog-starter | Repository still carrying the PolinRider loader at HEAD on 2026-09-30 (Ethereum wallet 0x33ff3eda, marker 5-2-314-du, 1 infected file(s) in the index, 54 stars, 6 forks). Owner is a probable victim; do not clone or build. Evidence: https://github.com/gumlau/nextjs-seo-blog-starter/blob/a76b91d8b06b657fb0cf35ba7568c1354b817942/next.config.ts | 1 | |
| github repoflecs-hub/flecs-polyglot | Repository still carrying the PolinRider loader at HEAD on 2026-09-30 (Ethereum wallet 0x33ff3eda, marker 5-2-457-du, 1 infected file(s) in the index, 62 stars, 4 forks). Owner is a probable victim; do not clone or build. Evidence: https://github.com/flecs-hub/flecs-polyglot/blob/a200d50cde253dd87f22942ee707f7d66a1a5c3e/ts/examples/basic/src/index.ts | 1 | |
| github repoTheSentora/Crypto-Web3-Copilot-App | Repository still carrying the PolinRider loader at HEAD on 2026-09-30 (Ethereum wallet 0x33ff3eda, marker 1-23, 2 infected file(s) in the index, 369 stars, 2 forks). Owner is a probable victim; do not clone or build. Evidence: https://github.com/TheSentora/Crypto-Web3-Copilot-App/blob/5869c7c4ed809e939ee825308c93ae7dc8ac67a5/copilot-app/Ai/Ai/next.config.js | 1 | |
| github reposubramanianv/CertificateVerification | Repository still carrying the PolinRider loader at HEAD on 2026-09-30 (Ethereum wallet 0x33ff3eda, marker 8-11356, 1 infected file(s) in the index, 379 stars, 2 forks). Owner is a probable victim; do not clone or build. Evidence: https://github.com/subramanianv/CertificateVerification/blob/a4d2f786caafed56bbe7776db5ca3b7f6366c601/webpack.config.js | 1 | |
| github repomorganjweaver/liquibet | Repository still carrying the PolinRider loader at HEAD on 2026-09-30 (Ethereum wallet 0x33ff3eda, marker 8-10173, 1 infected file(s) in the index, 237 stars, 1 forks). Owner is a probable victim; do not clone or build. Evidence: https://github.com/morganjweaver/liquibet/blob/a789efb022f35b5d7f0fb6159cdabf4ddc6f7c71/frontend/postcss.config.js | 1 | |
| github repoDhruvone8/iChat | Repository still carrying the PolinRider loader at HEAD on 2026-09-30 (Ethereum wallet 0x33ff3eda, marker 1-35, 1 infected file(s) in the index, 370 stars, 0 forks). Owner is a probable victim; do not clone or build. Evidence: https://github.com/Dhruvone8/iChat/blob/2dcef82f361c07c2e13c14053e6cdf40b34684e7/backend/server.js | 1 | |
| github repoWeb3-Builders-Alliance/convergence | Repository still carrying the PolinRider loader at HEAD on 2026-09-30 (Ethereum wallet 0x33ff3eda, marker 8-10197, 1 infected file(s) in the index, 218 stars, 0 forks). Owner is a probable victim; do not clone or build. Evidence: https://github.com/Web3-Builders-Alliance/convergence/blob/e2e92e2a4df749258905dc67920fb26be8a2cd2c/app/postcss.config.js | 1 | |
| github repoLynxverse/lynxverse.io | Repository still carrying the PolinRider loader at HEAD on 2026-09-30 (Ethereum wallet 0x33ff3eda, marker 8-10702, 2 infected file(s) in the index, 377 stars, 0 forks). Owner is a probable victim; do not clone or build. Evidence: https://github.com/Lynxverse/lynxverse.io/blob/d29d777d094f6b0c94d979653bdecbb7efcfadf2/postcss.config.js | 1 | |
| github repocreativetimofficial/black-dashboard-django | Repository still carrying the PolinRider loader at HEAD on 2026-09-30 (Ethereum wallet 0xa322E5f3, marker A9-0337-4, 1 infected file(s) in the index, 232 stars, 531 forks). Owner is a probable victim; do not clone or build. Evidence: https://github.com/creativetimofficial/black-dashboard-django/blob/f55a30c353e1d7b06ff169cd7dd2595a2962b736/postcss.config.js | 1 | |
| github repocreativetimofficial/argon-dashboard-django | Repository still carrying the PolinRider loader at HEAD on 2026-09-30 (Ethereum wallet 0xa322E5f3, marker A9-0337-4, 1 infected file(s) in the index, 176 stars, 513 forks). Owner is a probable victim; do not clone or build. Evidence: https://github.com/creativetimofficial/argon-dashboard-django/blob/f3c0a8f8b7f3b2051c9366d044d4054cca643560/apps/static/assets/vendor/bootstrap-datetimepicker.js | 1 | |
| github repocreativetimofficial/material-dashboard-django | Repository still carrying the PolinRider loader at HEAD on 2026-09-30 (Ethereum wallet 0xa322E5f3, marker A9-0337-4, 1 infected file(s) in the index, 99 stars, 418 forks). Owner is a probable victim; do not clone or build. Evidence: https://github.com/creativetimofficial/material-dashboard-django/blob/fab45b237af2a97f40d980a4a36febd96a382505/postcss.config.js | 1 | |
| github repocreativetimofficial/argon-dashboard-flask | Repository still carrying the PolinRider loader at HEAD on 2026-09-30 (Ethereum wallet 0xa322E5f3, marker A9-0337-4, 1 infected file(s) in the index, 79 stars, 311 forks). Owner is a probable victim; do not clone or build. Evidence: https://github.com/creativetimofficial/argon-dashboard-flask/blob/0ca599415baae8a2653e548eceb7c96255100485/apps/static/assets/vendor/bootstrap-datetimepicker.js | 1 | |
| github repoCommunityPro/portfolio-html | Repository still carrying the PolinRider loader at HEAD on 2026-09-30 (Ethereum wallet 0xa322E5f3, marker A8-*#new, 1 infected file(s) in the index, 677 stars, 292 forks). Owner is a probable victim; do not clone or build. Evidence: https://github.com/CommunityPro/portfolio-html/blob/724291e11152425565ea77e3a6041f7a33eb7119/public/fonts/fa-solid-400.woff2 | 1 | |
| github repoMshandev/Food-Delivery | Repository still carrying the PolinRider loader at HEAD on 2026-09-30 (Ethereum wallet 0xa322E5f3, marker A9-0258-2, 2 infected file(s) in the index, 218 stars, 212 forks). Owner is a probable victim; do not clone or build. Evidence: https://github.com/Mshandev/Food-Delivery/blob/81e064ef4afbd0c68d9c79a5b878bbae414e6e33/admin/vite.config.js | 1 | |
| github repotailwindadmin/admin | Repository still carrying the PolinRider loader at HEAD on 2026-09-30 (Ethereum wallet 0xa322E5f3, marker A10-*23720, 1 infected file(s) in the index, 478 stars, 95 forks). Owner is a probable victim; do not clone or build. Evidence: https://github.com/tailwindadmin/admin/blob/e818e8e74aad30a5dedf9f54ab69428011bf67be/postcss.config.js | 1 | |
| github reporichardokonicha/parsesig | Repository still carrying the PolinRider loader at HEAD on 2026-09-30 (Ethereum wallet 0xa322E5f3, marker A8-*#, 1 infected file(s) in the index, 58 stars, 45 forks). Owner is a probable victim; do not clone or build. Evidence: https://github.com/richardokonicha/parsesig/blob/e04574879b056cec8b5dc3ec7e92511dcafdafaf/public/fonts/fa-solid-400.woff2 | 1 | |
| github repoIamzaryab/Flutter-Movie-App-with-Clean-Architecture-and-RiverPod-State-Management | Repository still carrying the PolinRider loader at HEAD on 2026-09-30 (Ethereum wallet 0xa322E5f3, marker A10-*020, 1 infected file(s) in the index, 108 stars, 27 forks). Owner is a probable victim; do not clone or build. Evidence: https://github.com/Iamzaryab/Flutter-Movie-App-with-Clean-Architecture-and-RiverPod-State-Management/blob/6c1c25b5df3c251001c87da2f843d792789cda30/public/fonts/fa-solid-400.woff2 | 1 | |
| github repoZahraShahid/MyRealEstateWebsite | Repository still carrying the PolinRider loader at HEAD on 2026-09-30 (Ethereum wallet 0xa322E5f3, marker A9-146-1, 1 infected file(s) in the index, 119 stars, 21 forks). Owner is a probable victim; do not clone or build. Evidence: https://github.com/ZahraShahid/MyRealEstateWebsite/blob/cf1dd1f0c02a40cd5e148eed73f6d04d6797fde9/Backend/routes/AboutUs.js | 1 | |
| github repogigabytedevelopers/FireFiles | Repository still carrying the PolinRider loader at HEAD on 2026-09-30 (Ethereum wallet 0xa322E5f3, marker A8-ne, 1 infected file(s) in the index, 70 stars, 18 forks). Owner is a probable victim; do not clone or build. Evidence: https://github.com/gigabytedevelopers/FireFiles/blob/99216df3fbc8a131e7d051f3feb373cc00c54ac6/public/fonts/fa-solid-500.woff2 | 1 | |
| github repoumairjameel321/next-auth-mongodb | Repository still carrying the PolinRider loader at HEAD on 2026-09-30 (Ethereum wallet 0xa322E5f3, marker A8-3465, 1 infected file(s) in the index, 116 stars, 17 forks). Owner is a probable victim; do not clone or build. Evidence: https://github.com/umairjameel321/next-auth-mongodb/blob/794095709f4c945ff7e7e5955fb35a8114d23e10/postcss.config.js | 1 | |
| github repoumairjameel321/next14-restapis | Repository still carrying the PolinRider loader at HEAD on 2026-09-30 (Ethereum wallet 0xa322E5f3, marker A8-3465, 1 infected file(s) in the index, 61 stars, 17 forks). Owner is a probable victim; do not clone or build. Evidence: https://github.com/umairjameel321/next14-restapis/blob/c16c26764204a9bfdbfc6f3fdeb81a12834b0ab4/postcss.config.mjs | 1 | |
| github repomE-uMAr/fastapi-crons | Repository still carrying the PolinRider loader at HEAD on 2026-09-30 (Ethereum wallet 0xa322E5f3, marker A10-*020, 1 infected file(s) in the index, 92 stars, 14 forks). Owner is a probable victim; do not clone or build. Evidence: https://github.com/mE-uMAr/fastapi-crons/blob/f470028674a07a8ac229071ecf6a3628c537790e/public/fonts/fa-solid-400.woff2 | 1 | |
| github repoumairjameel321/authjsv5nextjs | Repository still carrying the PolinRider loader at HEAD on 2026-09-30 (Ethereum wallet 0xa322E5f3, marker A8-3465, 1 infected file(s) in the index, 86 stars, 8 forks). Owner is a probable victim; do not clone or build. Evidence: https://github.com/umairjameel321/authjsv5nextjs/blob/906ca62e278d708e73e3dd3ba0c26fd88d72b920/postcss.config.mjs | 1 | |
| github repooslabs-beta/projectArtemis | Repository still carrying the PolinRider loader at HEAD on 2026-09-30 (Ethereum wallet 0xa322E5f3, marker A8-*#, 1 infected file(s) in the index, 86 stars, 8 forks). Owner is a probable victim; do not clone or build. Evidence: https://github.com/oslabs-beta/projectArtemis/blob/a4d3e4a686d18fa73f1bf4d92e414f3ee3199bf2/public/fonts/fa-solid-400.woff2 | 1 | |
| github repoboostcampwm-2022/android04-BEEP | Repository still carrying the PolinRider loader at HEAD on 2026-09-30 (Ethereum wallet 0xa322E5f3, marker A8-*#new, 1 infected file(s) in the index, 80 stars, 2 forks). Owner is a probable victim; do not clone or build. Evidence: https://github.com/boostcampwm-2022/android04-BEEP/blob/8ce55b1cf74e000d1ada7d2b5b20fcd0fe04a38d/public/fonts/fa-solid-400.woff2 | 1 | |
| github reposuleman-the-stammer/zeropark-master | Repository still carrying the PolinRider loader at HEAD on 2026-09-30 (Ethereum wallet 0xa322E5f3, marker A10-*3046-20, 1 infected file(s) in the index, 123 stars, 0 forks). Owner is a probable victim; do not clone or build. Evidence: https://github.com/suleman-the-stammer/zeropark-master/blob/93e9ccc81d78648123b08399267ec942025e76cc/vite.config.js | 1 | |
| github repoecho-riga/Help-Desk-System | Repository still carrying the PolinRider loader at HEAD on 2026-09-30 (Tron TCqf6Zka (paired file), marker 1-34-1, 1 infected file(s) in the index, 370 stars, 1 forks). Owner is a probable victim; do not clone or build. Evidence: https://github.com/echo-riga/Help-Desk-System/blob/7a5f99638eb224ee5810897a58fc8ea797f91fd8/frontend/vite.config.js | 1 | |
| github repoSahilSharan/multimart-react-ecommerce-main | Repository still carrying the PolinRider loader at HEAD on 2026-09-30 (Tron TCqf6Zka (paired file), marker 1-36-1, 1 infected file(s) in the index, 371 stars, 0 forks). Owner is a probable victim; do not clone or build. Evidence: https://github.com/SahilSharan/multimart-react-ecommerce-main/blob/3ab63f2a9d46df0201889a1a7040560972e38022/src/index.js | 1 | |
| github repoLeoneldev532/Free-Ui-game | Repository still carrying the PolinRider loader at HEAD on 2026-09-30 (Tron TCqf6Zka (paired file), marker 1-31-1, 1 infected file(s) in the index, 367 stars, 0 forks). Owner is a probable victim; do not clone or build. Evidence: https://github.com/Leoneldev532/Free-Ui-game/blob/d531092c2726551a313e2f342ff7bb0d1c740cf5/postcss.config.mjs | 1 | |
| github repodevpardo/mannylapidamaker | Repository still carrying the PolinRider loader at HEAD on 2026-09-30 (Tron TCqf6Zka (paired file), marker 1-26-1, 1 infected file(s) in the index, 368 stars, 0 forks). Owner is a probable victim; do not clone or build. Evidence: https://github.com/devpardo/mannylapidamaker/blob/74939f477789077e9bb33d05c01005704c015ca4/postcss.config.mjs | 1 | |
| wallet0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891 | Ethereum operator wallet, branch A of the PolinRider Ethereum generation. Sends a 0/150/500-wei heartbeat tx every 256 blocks (2,895 tx 2026-06-23 to 2026-09-30); the tx 'to' address encodes two IPv4:port C2 pairs. Loader matches 'from' on substring 33ff3edaf55a8e03dcbc7cb40d498a49. | 1 | |
| wallet0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a | Ethereum operator wallet, branch B ("A" markers). Heartbeat every 1000 blocks since 2026-07-25 (491 tx); 'to' address = two IPv4 + ASCII helloipbot!! (68656c6c6f6970626f742121). Also found in 70 OpenSSF malicious-packages records. | 1 | |
| walletTCqf6ZkaQD84vYsC2cuu1jRwB6JveTaRrF | Tron primary dead-drop address used by paired PolinRider files with markers ending in -1 (e.g. global.i='1-35-1'). Not in earlier public reports. | 1 | |
| walletTFMryB9m6d4kBMRjEVyFRbqKSV1cV2NcpH | Tron fallback dead-drop address used by paired PolinRider files with markers ending in -1. | 1 | |
| wallet0x3d2075f97b7b1e3234bd653779d21c605d7d8c6ec9c98d983880be5c7f4f9471 | Aptos account used by paired PolinRider files with markers ending in -1. | 1 | |
| wallet0x9d202c824402ca89e9aaccd2390b6f8b332ae743caa1469c695feb2781d56519 | Aptos account used by paired PolinRider files with markers ending in -1. | 1 | |
| wallet0xd31A213E77C0E3Be774bD0DdBC86cf2D86090B59 | Funded Ethereum operator wallet 0x33ff3eda...9891 on 2026-06-23 (0.01 ETH, 93 minutes before the first heartbeat) and 2026-08-04. | 1 | |
| wallet0x76D6dDCBDE60c1DFDBE4E836D7122C3B49216907 | Funded Ethereum operator wallet 0x33ff3eda...9891 on 2026-09-28. | 1 | |
| ipv423.27.20.187 | Branch A (0x33ff) C2 2026-06-23 to 2026-09-03, ports 80 and 443 (/boot, /0/boot). AS149440 Evoxt. | 1 | |
| ipv4181.214.149.147 | Branch A (0x33ff) C2 2026-09-03 to 2026-09-07 (/boot :443, /0/boot :80). AS397423 Tier.Net. | 1 | |
| ipv4181.214.149.148 | Branch A (0x33ff) C2 2026-09-07 to 2026-09-25 (/boot :443, /0/boot :80). AS397423 Tier.Net. | 1 | |
| ipv445.137.198.133 | Branch A (0x33ff) C2 #2 from 2026-09-28 on :80: /0/boot, /0/body (XOR key YU7m{rE/>|==b>#~), /snv (process.env exfiltration), /$/1 (Python infostealer). nginx/1.30.4. AS212477 RoyaleHosting. | 1 | |
| ipv423.27.13.135 | Branch B (0xa322) C2 2026-08-22 to 2026-08-27. AS149440 Evoxt. | 1 | |
| ipv4166.88.73.46 | Branch B (0xa322) C2 2026-08-28 to 2026-09-03. AS149440 Evoxt. | 1 | |
| ipv4193.247.144.38 | Branch B (0xa322) C2 2026-09-04 to 2026-09-17. AS149440 Evoxt. | 1 |