Skip to content

Back to the catalog

PolinRider Confirmed Footprint Grows 6.5x Since March
opensourcemalware.comwriteup

PolinRider Confirmed Footprint Grows 6.5x Since March

OpenSourceMalware's July hunt update on the PolinRider campaign (a Lazarus Group/DPRK operation linked to Contagious Interview and TasksJacker) found 2,417 newly-compromised GitHub repos, bringing the confirmed footprint to 4,367 repos across 2,152 owners — a 6.5x increase since March. The post breaks down the two injection vectors (94% config-file injection into files like postcss.config.mjs/tailwind.config.js/eslint.config.mjs, 6% payloads hidden in a .woff2 font file), shows the campaign overwhelmingly hits individual developer accounts rather than orgs, and republishes updated signature markers, decoder function names, and grep-based detection/remediation steps.

TL;DR PolinRider (Lazarus Group/DPRK) supply-chain campaign has grown 6.5x since March to 4,367 poisoned GitHub repos, driven by config-file injection and a fake-font (.woff2) payload technique, with fresh IOCs and detection greps provided.
Open original ↗
Document

What it is

A July 2026 follow-up threat report on PolinRider, a Lazarus Group (DPRK) supply-chain campaign that farms individual developers' GitHub accounts by forking popular projects and submitting malicious pull requests. It is tied to the Contagious Interview and TasksJacker operations, initially weaponizing credentials stolen by TasksJacker. Named targets include VS Code, Apache Superset, Rails, LangFlow, and Expo.

How it works

The payload is an obfuscated JavaScript loader placed where it runs automatically but escapes code review. This round gives the first clean vector breakdown across 2,417 newly confirmed repos:

  • 93.9% (2,270 repos) — config-file injection into postcss.config.mjs, tailwind.config.js, eslint.config.mjs; executes when the project is installed or opened.
  • 5.9% (142 repos) — fake-font vector: the same payload smuggled inside public/fonts/fa-solid-400.woff2, a file no developer opens. First seen as a curiosity in April, now a standing technique.
  • 0.2% (5 repos) — both: a config injection plus a TasksJacker payload in .vscode/tasks.json — on-disk evidence of the campaign merger.

Preconditions / Affected

GitHub public repositories, overwhelmingly personal accounts (2,260 of 2,417 this round; only 157 organizations). The risk lands on developers who run take-home coding tests, install unfamiliar frontend templates, or clone project starters from strangers. A separate July 8 report ("Jumps the Fence") indicates spread beyond GitHub into Go, Packagist, npm, and PyPI.

What to do

The page's operational guidance: treat every config and font file as untrusted until checked when handling take-home tests, unknown templates, or third-party starters. Concretely, inspect these files in cloned/forked projects before installing or opening:

  • postcss.config.mjs, tailwind.config.js, eslint.config.mjs
  • public/fonts/fa-solid-400.woff2 (and other .woff2 files — a font should not contain JavaScript)
  • .vscode/tasks.json (TasksJacker component)

Caveats

The authors state all figures are an undercount. GitHub API pagination limits, Sourcegraph indexing lag, deleted/privatized repos, and infections on non-default branches all keep the confirmed total below the true one. Note the growth reading: the July round is almost entirely net-new (only 2 of 2,417 overlap April), so cumulative counts stack rather than replace — 675 → 1,951 → 4,367 confirmed repos across the three rounds.

Technologies named here

Techniques named here

  • Config file injection
  • Fake-font vector
  • Supply-chain compromise via malicious pull requests
  • Self-propagation via victim GitHub accounts
  • Combined config-injection + TasksJacker payload

Threat actors named here

Related in Supply Chain