Skip to content

Back to the catalog

PolinRider Spreads Through Compromised GitHub Accounts and Packagist
socket.devarticle

PolinRider Spreads Through Compromised GitHub Accounts and Packagist

Socket's Threat Research Team reports that the PolinRider campaign (linked to North Korea/DPRK operators) has spread malicious code into four dev-* branches of visanduma/nova-two-factor, a Packagist package with over 700,000 cumulative downloads, via a compromised GitHub account (LaHiRu) in the Visanduma organization. The post details the campaign's tradecraft — hiding payloads in .woff2 font files, using VS Code's "runOn": "folderOpen" task trigger, and a new technique inserting obfuscated JavaScript directly into index.php executed via PHP's shell_exec — and explains how Packagist/Go modules resolving code straight from Git repos lets planted source code reach downstream users without stolen registry credentials. It provides IOCs (package versions, wallet address, IPs, file hashes) and frames PolinRider as a slow, persistent Git-collaboration-based intrusion campaign primarily aimed at cryptocurrency theft.

TL;DR Socket details PolinRider's latest move: a compromised GitHub account planted malware in dev branches of a 700K-download Packagist package, spreading via Git-based collaboration rather than registry compromise.
Open original ↗
Document

What it is

An update to Socket's tracking of PolinRider (North Korea–linked) confirming malicious code in visanduma/nova-two-factor, a Packagist package with 700,000+ cumulative downloads. The payload sits only in the four unstable dev branches — dev-main, dev-nova4support, dev-using-inertia, dev-nova50 — with no stable malicious release identified at time of writing.

Preconditions / Affected

  • You are exposed only if you consume the development branches directly. Normal stable-version installs are not implicated by this finding.
  • The Visanduma GitHub org has been compromised since mid-June 2026, via the LaHiRu developer account. Hundreds of contributions to private repos after compromise mean the full repository-level reach is unknown.

How it works

Four recurring techniques carry the infection:

  • Payloads hidden in .woff2 font files (low review scrutiny).
  • "runOn": "folderOpen" in .vscode/tasks.json, firing when the repo is opened in a VS Code–compatible IDE.
  • A newer variant: heavily obfuscated JavaScript inserted directly into index.php and executed via PHP's shell_exec, letting a PHP entry point launch the JS chain.

Because Go modules and Packagist can resolve code straight from Git, planted source reaches downstream users without stolen registry credentials. The operators wait for routine dev/release activity to carry the payload forward rather than pushing a fast malicious release.

What to do

  • Do not pin to or pull the affected dev branches; treat the repo's source history as suspect, not just current HEAD.
  • Hunt for shell_exec calls that launch Node.js or decoded commands.
  • Block/alert on the published IOCs: wallet 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a; IPs 193.247.144.38, 166.88.73.46, 166.88.134.62, 223.27.13.135; file hashes including 7d47c430e6e404dc2fa8b4837678d1cbdb4d0aeacec9b405655cab79d54a2ad9 (tailwind.config.js).

Caveats

  • The dev-only finding limits conclusions about stable-install exposure — but does not clear it, given inaccessible private repos and source history.
  • Cleaning the repository does not establish that workstations or CI hosts are clean. Once a later-stage payload executes, the host stays compromised independently; affected developers report difficulty removing later-stage components.
  • Objective is primarily cryptocurrency theft, but the stealer may also exfiltrate credentials and source code.

Organisations named here

  • LaHiRu

Technologies named here

  • Socket
  • visanduma/nova-two-factor
  • GitHub Code Search
  • Visanduma GitHub organization repositories
  • LaHiRu developer account
  • PHP projects
  • npm, PyPI, Go modules, Packagist, Chrome extensions
  • Packagist
  • GitHub
  • PHP
  • Node.js
  • VS Code

Techniques named here

  • Hiding malicious payloads in .woff2 font files
  • VS Code folderOpen task trigger
  • PHP-to-JavaScript execution bridge
  • shell_exec command execution
  • Git-based ecosystem resolution abuse
  • Developer account compromise via Git collaboration

Threat actors named here

  • PolinRider
  • DPRK

Related in Supply Chain