Loading malware…
PolinRider is a DPRK-linked software supply-chain malware campaign and JavaScript loader family targeting developer environments across npm, Go modules, Packagist, Rust crates, compromised source repositories, and malicious browser extensions. It is associated with compromise of legitimate maintainer accounts and developer machines, enabling attackers to append obfuscated code to otherwise functional packages and repositories. Execution has occurred at package import time and through automatically triggered Visual Studio Code workspace tasks, allowing payload activation outside conventional package-install lifecycle hooks.
PolinRider loaders use public blockchain transaction data, including Tron, Aptos, BNB Smart Chain, and Ethereum, as dead-drop infrastructure for multi-stage payload resolution. Retrieved stages are decrypted and dynamically executed; some execution paths create detached background processes. The family has been linked to follow-on payloads including DEV#POPPER, InvisibleFerret, and probable OmniStealer variants. These payloads provide remote access, command execution, host and process discovery, file operations, credential and browser-data theft, cryptocurrency-wallet data theft, clipboard capture, keylogging, and persistence through modifications to developer-focused applications.
The operation primarily targets software developers, build environments, and organizations whose software packages or source repositories can be repurposed for downstream supply-chain distribution. Reported activity affects Windows, macOS, and Linux systems. Attribution is assessed as DPRK-linked based on recurring infrastructure, blockchain-resolver design, cryptographic markers, propagation tradecraft, and overlaps with Contagious Interview-associated malware, though individual incidents may have varying attribution confidence.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
PolinRider is supply-chain campaign that hides obfuscated JavaScript inside compromised developers' .vscode/tasks.json files, fake .woff2 fonts, and legitimate config files like tailwind.config.js, postcss.config.mjs, eslint.config.mjs, App.js and babel.config.cjs.
북한 라자루스(Lazarus)로 추정 구글 크롬 웹 스토어 PolinRider 악성코드 분석-YouTube Translator: Captions, Transcript & AI Summary로 유포되고 있는 악성코드
Security researchers have uncovered a campaign called PolinRider that hides malicious JavaScript loaders inside trusted code repositories, waiting for unsuspecting developers to run them.
29 distinct techniques documented for this family, organized by ATT&CK tactic.
“The operators compromise developer accounts, insert malicious content into source repositories” and malicious changes were introduced through the compromised “LaHiRu” developer account.
"PolinRider Spreads Through Compromised GitHub Accounts and Packagist"
“Patched configuration files execute during build activity” and “heavily obfuscated JavaScript was inserted directly into index.php and executed through PHP’s shell_exec function.”
“The operators compromise developer accounts, insert malicious content into source repositories” and malicious changes were introduced through the compromised “LaHiRu” developer account.
[The payload] ran it with eval and as a detached background process that outlives the editor.
The task was set to "runOn": "folderOpen" with "reveal": "never", so it started on its own and showed nothing.
The fallback C2 path adds persistence: if the primary eval() fails, the payload is launched as a detached node -e child process with windowsHide: true and stdio: 'ignore'
“The operators compromise developer accounts, insert malicious content into source repositories” and malicious changes were introduced through the compromised “LaHiRu” developer account.
[The payload] ran it with eval and as a detached background process that outlives the editor.
“Malicious JavaScript is hidden in configuration files or files presented as .woff2 fonts” and a variation used “heavily obfuscated JavaScript.”
L’implant utilise un mécanisme de résolution de payload via des transactions blockchain publiques (Tron, Aptos, BNB Smart Chain) pour récupérer du code chiffré, le déchiffrer par XOR, et l’évaluer dynamiquement.
That file is not a font. It is 32,645 bytes of obfuscated JavaScript. The fifteen real FontAwesome files next to it were camouflage.
“Malicious JavaScript is hidden in configuration files or files presented as .woff2 fonts, locations developers are less likely to inspect during code review.”
fake .woff2 fonts... public/fonts/fa-solid-400.woff2, not a font. Plaintext JavaScript with a .woff2 extension.
The fallback C2 path adds persistence: if the primary eval() fails, the payload is launched as a detached node -e child process with windowsHide: true and stdio: 'ignore'
removed the visible symptom but missed mechanism... the fake public/fonts/fa-solid-400.woff2 payload disappeared from the shipped tarball... But the trigger, .vscode/tasks.json ... was left in place
Several of the pushed commits carry backdated author/committer dates... one on html-to-jsx-demo claims 2025-11-06 while the actual push arrived 2026-07-31
“The operators compromise developer accounts, insert malicious content into source repositories” and malicious changes were introduced through the compromised “LaHiRu” developer account.
Try Tron first... catch (e) { // Fallback to Aptos ... } ... try { txInput = await fetchFromBSC('bsc-dataseed.binance.org'); ... } catch (e) { txInput = await fetchFromBSC('bsc-rpc.publicnode.com'); }
"Joyfill npm Packages Compromised with Blockchain C2 Loader"
Loader de 5 849 octets configurant le endpoint Socket.IO (166.88.134.62:443) ... Requête vers 23.27.13.43/$/boot avec header Sec-V: A9-0135-3
The C2 resolution chain is identical... Tron ... The result is a BSC transaction hash. BSC ... decode ... XOR decrypt with the hardcoded key and eval().
“The initial code resolves C2 infrastructure through a dead-drop mechanism, using techniques including EtherHiding and, more recently, NullReceiver.”
87 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
35 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A malware family referenced because its use of numeric campaign identifiers resembles WeaselBiscuit's installation-ID scheme.
Mentioned solely as a point of comparison for the use of numerical campaign IDs.
A named malicious campaign or malware family reported to spread through compromised GitHub accounts and the Packagist package ecosystem.
A malicious PolinRider variant was embedded in a compromised greentic-setup-dev crate release. It would execute when a project that depended on the crate was opened in Visual Studio Code.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.