PolinRider Caused Dozens of npm, Go, PHP Compromises

What it is

An OpenSourceMalware analysis of 20 npm and Go packages carrying DPRK's PolinRider malware, prompted by Socket's report of two poisoned Joyfill beta releases (a legitimate PDF/form automation platform) deploying a RAT. The core argument: these are not deliberate account takeovers but the fallout from PolinRider holding persistence on thousands of developer machines, which auto-propagate malicious publishes using whatever credentials sit on the box.

How it works

The payload ships as public/fonts/fa-solid-400.woff2 — a file with a font extension that actually contains JavaScript. A malicious VS Code task auto-runs it. Once a compromised maintainer's machine consumes the malware, it harvests local credentials and pushes backdoored versions under the owner's identity without consent, propagating to any repo/package that account can reach.

Preconditions / Affected

Individual developers running affected packages, or maintainers whose machines are already infected via PolinRider's entry vectors (fake interviews, poisoned forks, malicious VS Code tasks, typosquats). The report stresses low-profile targets: e.g. npm user digelim's html-to-gutenberg and fetch-page-assets pull under 2k downloads/week combined — too small to be deliberately chosen. 93.5% of confirmed PolinRider victims are individual developer accounts.

What to do

Hunt for these indicators, drawn directly from the report:

• The file public/fonts/fa-solid-400.woff2 containing JavaScript rather than font data. Nextron's 16 Go modules all carried this file with matching SHA-256 hashes — hash-pivot across your dependencies.
• VS Code tasks configured to auto-run on open.
• On-chain artifacts: Tron, Aptos, and BNB Smart Chain transactions. Attribution is anchored on one shared XOR key and two identical TRON wallet addresses across all 20 samples.
• Treat any package published by the listed maintainers (digelim, Joyfill, the lambda-platform and glacialspring modules, etc.) in the named versions as suspect and review credential exposure on maintainer machines, not just the package.

Caveats

• The dataset is 20 packages, though the title claims "dozens" and "27 legitimate packages," and it names npm/Go/PHP while the analyzed set is npm and Go only (Packagist/PHP appears only via a linked prior report).
• Original discoverers (JFrog, Nextron, Socket) described these as compromised maintainer accounts; JFrog reported the two npm packages on June 24, 2026 and did not attribute them, amending on June 26, 2026 to reference Nextron's Go findings. The "not really ATOs" framing is OpenSourceMalware's interpretation of campaign behavior, not the discoverers' conclusion.
• PolinRider's end goal is stated as unknown.

The page text is truncated mid-sentence, so the full package table and any further mitigations are not fully captured here.