Ongoing NPM attack adminide-stack tab-padded eval(atob) with an ETH dead-drop
Comments on “Ongoing NPM attack adminide-stack tab-padded eval(atob) with an ETH dead-drop”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Greenflagged reports an ongoing npm compromise: on 2026-11-03 the account clockbook-app published malicious versions of @adminide-stack packages and server-hemera-mongo, each appending a tab-padded eval(atob(...)) loader to the entry file. The script reads an Ethereum wallet's latest transaction, derives a C2 IPv4 address from it, and fetches the next stage. Plain installs of utils and client-redux now resolve to bad versions. The analysis was static; stage 2 was not examined. The figures come from Greenflagged alone, with no independent source cited.
Why it ranked
No. 1 of 137 with a score of 0.80. The panel rated it highest on technical depth (0.96) and substantiated (0.94), lowest on audience breadth (0.68).
- AI judgeJudge 2claude-haiku-5-5
- Detailed, well-evidenced write-up of an active npm supply-chain malware campaign with IOCs, hashes and decoded behavior; highly actionable for builders and security teams, though narrower than a landmark.
- AI judgeJudge 3gpt-5.6-luna
- A highly detailed, evidence-backed npm supply-chain compromise with obfuscation, C2, blockchain dead-drop, indicators, detection guidance, and response timing. It is directly actionable for JavaScript maintainers and security teams.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.80total under rubric v2.3
- Significance0.72
- Reader interest0.92
- Audience breadth0.68
- Practical relevance0.87
- Substantiated0.94
- Technical depth0.96
- New information0.93
- Counts against: Promotional0.07
- Counts against: Overclaim0.14
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.67 | 0.70 | 0.78 | 0.72 | 0.11 | +0.24 | +0.172 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.86 | 0.93 | 0.96 | 0.92 | 0.10 | +0.26 | +0.238 |
| Audience breadthHow many people who build technology does it concern? | 0.57 | 0.80 | 0.67 | 0.68 | 0.23 | +0.13 | +0.088 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.86 | 0.85 | 0.90 | 0.87 | 0.05 | +0.22 | +0.192 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.97 | 0.90 | 0.94 | 0.94 | 0.07 | +0.05 | +0.047 |
| Technical depthHow technically substantive is it? | 1.00 | 0.92 | 0.95 | 0.96 | 0.08 | +0.05 | +0.048 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.89 | 0.93 | 0.98 | 0.93 | 0.09 | +0.05 | +0.047 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.05 | 0.12 | 0.03 | 0.07 | 0.09 | −0.19 | −0.013 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.24 | 0.15 | 0.04 | 0.14 | 0.20 | −0.11 | −0.016 |
| Sum of contributions | +0.803 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.803 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-11-04/1/"><img src="https://rubric.hrih.si/badge/2026-11-04/1.svg" alt="Ranked #1 on Rubric, 4 Nov 2026" width="231" height="28"></a>Claim check
Claim check: 8 no source given. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
No source givenDate
Three npm packages received a new version within 11m38s on 2026-11-03, between 22:00:33 and 22:12:11 UTC.
The article gives no link or citation for it.
The article says “Three npm packages got a new version within 11m38s on 2026-11-03, from 22:00:33 to 22:12:11 UTC”
The source says No source to compare with.
No source givenNumber
The base64 blob is 50,336 characters in all three first-wave packages and decodes to the same 37,751-byte script.
The article gives no link or citation for it.
The article says “The base64 blob is 50,336 chars in all three. It decodes to the same 37,751-byte script”
The source says No source to compare with.
No source givenCausal conclusion
The malicious script reads the latest transaction sent by an Ethereum wallet, converts the to address into an IPv4 C2 address, and fetches and runs the next stage from it.
The article gives no link or citation for it.
The article says “The script reads the latest transaction sent by an Ethereum wallet, turns the to address into an IPv4 C2 address, and fetches and runs the next stage from it”
The source says No source to compare with.
No source givenCausal conclusion
A plain npm install of @adminide-stack/utils resolves to the malicious 0.0.16-130 because it moved both latest and next.
The article gives no link or citation for it.
The article says “0.0.16-130 moved both latest and next. A plain npm install @adminide-stack/utils resolves to it”
The source says No source to compare with.
No source givenNumber
Across the 190 packages maintained by the 18 accounts, only 3 of 109 versions published since 2026-10-27 carried the payload at the 22:40 UTC check.
The article gives no link or citation for it.
The article says “At 22:40 UTC there were 109 versions, and only these 3 carry the payload”
The source says No source to compare with.
No source givenNumber
The dead-drop wallet has 226 transactions, 225 sent and 1 received, and every sent transaction has value 0.
The article gives no link or citation for it.
The article says “It has 226 transactions: 225 sent and 1 received, from 0x4e5b2e1dc63f6b91cb6cd759936495434c7e972f on 2026-10-14. Every sent transaction has value 0”
The source says No source to compare with.
No source givenNumber
The current C2 address was re-posted about every 3h20m, and 95.135.181.151 was seen in 135 transactions from 2026-10-16 to 2026-11-03.
The article gives no link or citation for it.
The article says “The current address is re-posted about every 3h20m”
The source says No source to compare with.
No source givenDate
Greenflagged's AI reviewer rejected server-hemera-mongo 0.0.15 with confidence 97 at 22:30:00 UTC, after import at 22:12:21.
The article gives no link or citation for it.
The article says “22:30:00 AI reviewer rejects email protected, confidence 97”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 1 pts, not on front page
Recorded for context only, checked 4 Nov 2026, 05:47 UTC. It played no part in the ranking.