Loading malware…
PolinRider is a DPRK-linked software supply-chain malware campaign publicly associated with Lazarus Group and the Contagious Interview activity cluster. It compromises legitimate GitHub maintainer accounts and tampers with trusted repositories, then propagates malicious release artifacts into ecosystems including Go modules, Packagist/Composer, npm, and at least one Chrome extension. Public reporting cited in the content ties the campaign to hundreds to thousands of compromised repositories, including 675 initially and later 1,951 repositories across 1,047 owners, as well as 108 unique malicious packages/extensions and 162 release artifacts.
Its primary tradecraft is to inject obfuscated JavaScript loaders into legitimate project files and developer tooling. Observed hiding locations include config files such as postcss.config.mjs, tailwind.config.js, eslint.config.mjs, vite.config.js, next.config.mjs, babel.config.js, app.js, and astro.config.mjs; fake .woff/.woff2 font files under public/static/assets paths; and VS Code workspace files including .vscode/tasks.json, extension.json, launch.json, and spellright.dict. A common execution method is a VS Code tasks.json entry with runOn set to folderOpen, causing code execution when a developer opens the repository in VS Code or Cursor. In npm cases, some packages were functional decoys whose malicious loader executed at import time rather than via lifecycle hooks.
The loader architecture described across the reporting uses public blockchain infrastructure as dead-drop command delivery. Samples queried TRON and Aptos to obtain pointers to BNB Smart Chain transactions whose input data contained XOR-encrypted payload stages, which were then decrypted and executed via eval(). Reported blockchain indicators include TRON addresses TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP and TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG, Aptos addresses 0xbe037400670fbf1c32364f762975908dc43eeb38759263e7dfcdabc76380811e and 0x3f0e5781d0855fb460661ac63257376db1941b2bb522499e4757ecb3ebd5dce3, and XOR keys 2[gWfGj;<:-93Z^C and m6:tTh^D)cBz?NM]. Additional reported loader markers include rmcej%otb%, _$_1e42, global['!'], Cot%3t=shtP, function MDy(f), and global['_V'].
Recovered stages and linked reporting indicate PolinRider commonly leads to BeaverTail/DEV#POPPER and InvisibleFerret/OmniStealer payloads. Reported capabilities of the later-stage malware include host fingerprinting, credential theft, browser-data theft, cryptocurrency wallet theft, remote command execution, and socket.io-based command and control. One documented branch of the chain used hard-coded C2 IPs 166.88.54.158, 198.105.127.210, and 23.27.202.27 and fetched /$/boot with a Sec-V header before XOR-decrypting and executing the response.
The campaign specifically targets software developers and cryptocurrency-sector personnel and overlaps with recruiter-lure operations attributed to Contagious Interview/Famous Chollima. It has also been observed using Git history manipulation to conceal tampering: force-pushed, anti-dated commits and Windows propagation scripts such as temp_auto_push.bat rewrite recent commits, preserve original timestamps, bypass hooks with --no-verify, and erase visible evidence of malicious changes. High-confidence examples in the content include malicious modifications to repositories and packages such as 7span/react-list, Xpos587/git2md, Xpos587/markfetch, Artiffusion-Inc/mirofish, roberts/leads dev-drewroberts/feature/test-case, and malicious npm packages tailwind-color-shades 1.0.2 and safe-validate 1.0.4.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
PolinRider is a DPRK-linked supply-chain campaign, part of the Lazarus Group / Contagious Interview activity cluster... PolinRider takes over legitimate GitHub accounts and quietly injects an obfuscated JavaScript loader into repositories the maintainer already owns.
OpenSourceMalware’s PolinRider reporting describes the same loader architecture as culminating in a DPRK BeaverTail variant and repository-propagation backdoor/infostealer behavior.
27 distinct techniques documented for this family, organized by ATT&CK tactic.
The moment the actor takes over a GitHub account and pushes a malicious commit... every Go module and every Composer package backed by that repo is automatically compromised too.
"PolinRider Jumps the Fence" published by OpenSourceMalware. #SupplyChain, #NPM, #PyPI, #VSCode, #PolinRider
Most of the time, the payload will be in the tasks.json file... a command that runs uses node to run one of the files pretending to be font files.
The technique is .vscode/tasks.json with "runOn": "folderOpen" ... For trusted workspaces, that happens silently, before any code review ... Drop a tasks.json like that into a repository, get a developer to open the repository in VS Code, and you have remote code execution on their machine.
A Windows script rewrites git history to hide the tampering... temp_auto_push.bat still rewrites the latest commit... bypasses pre-commit hooks with --no-verify , and force-pushes to erase the evidence.
.vscode/tasks.json with a runOn: folderOpen trigger that curl-pipes a shell command the instant a victim opens the project.
The same four infection methods and the same loader we documented on GitHub carried over into Go and Packagist: Obfuscated JavaScript appended to config files... | If you look at line 16 of the tasks.json file, you’ll see a command that runs uses node to run one of the files pretending to be font files: fa-solid-400.woff2.
Most of the time, the payload will be in the tasks.json file... a command that runs uses node to run one of the files pretending to be font files.
Most of the time, the payload will be in the tasks.json file... a command that runs uses node to run one of the files pretending to be font files.
takes over legitimate GitHub accounts and quietly injects an obfuscated JavaScript loader into repositories...
The payload hides in config files, fake .woff2 font files, and .vscode/tasks.json triggers... one or more of those fonts is actually malicious JavaScript. | A North Korean actor was quietly appending obfuscated JavaScript to config files inside legitimate repositories.
A Windows script rewrites git history to hide the tampering, making it look like a normal commit... temp_auto_push.bat still rewrites the latest commit to preserve its original timestamp... and force-pushes to erase the evidence.
The moment the actor takes over a GitHub account and pushes a malicious commit... every Go module and every Composer package backed by that repo is automatically compromised too.
Every invocation of astro build, astro dev, or astro preview from the affected branch runs the file as a Node.js module, and an obfuscated IIFE at the end fires automatically.
It issues an HTTP GET to /$/boot with a spoofed Chrome 131 desktop User-Agent. The Sec-V header exfiltrates the marker value...
The payload hides in config files... then uses blockchain dead-drops to download the Lazarus stealer toolkit.
The loader still resolves its second stage from blockchain dead-drops across TRON, Aptos, and BNB Smart Chain, decrypts it with embedded XOR keys, and runs it through eval().
Stage A runs concurrently with Stage B. It resolves a second-stage command through a three-chain relay... The attacker updates the active payload by sending one new BSC transaction from a wallet they control. No DNS record changes, no IP address updates, no server restarts.
25 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
"PolinRider Jumps the Fence" published by OpenSourceMalware. #SupplyChain, #NPM, #PyPI, #VSCode, #PolinRider
A DPRK-linked supply-chain malware campaign that compromises legitimate GitHub accounts and injects obfuscated JavaScript loaders into repositories, config files, fake .woff2 font files, and VS Code tasks. It leverages repo-backed package ecosystems such as Go modules and Packagist to distribute malicious code, uses blockchain dead-drops for second-stage retrieval, and rewrites git history to hide tampering.
A supply-chain malware campaign/tooling cluster that plants obfuscated JavaScript loaders in legitimate repositories and malicious packages/extensions, triggers execution through developer tooling such as VS Code task files, modifies project files, and retrieves encrypted second-stage payloads from blockchain infrastructure.
A supply-chain malware campaign that hides malicious JavaScript loaders in trusted repositories and packages across npm, Packagist, Go modules, and a Chrome extension. It abuses VS Code task files for execution, retrieves encrypted second-stage payloads via blockchain/public RPC services, decrypts them with an embedded XOR key, and executes them with eval.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.