Socket: PolinRider

What it is

PolinRider is a North Korea-linked supply chain campaign (tied to Contagious Interview / Famous Chollima) that Socket's Threat Research Team traced across 162 malicious release artifacts in 108 packages — specifically 80 Go modules, 10 Packagist packages, and one Chrome extension, in addition to npm. It remains active. The document's value over the summary is the defender's playbook: where to look (because the obvious places lie) and what to do after exposure.

How it works

Loaders are planted as one-line obfuscated JS, hidden either by whitespace-padding the line past the default screen width or inside fake .woff2 font files, and triggered by developer tooling such as VS Code task files. Once deobfuscated, the loader contacts blockchain/public RPC infrastructure (TRON, Aptos, BNB Smart Chain), pulls an encrypted second stage, decrypts it with embedded XOR keys, and runs it via eval(). Observed payloads: DEV#POPPER and OmniStealer — but the loader design means treat it as capable of delivering anything.

The key detection point: the GitHub landing page and commit history are unreliable. Attackers use force pushes and anti-dated commits so the visible file view and latest-commit metadata look benign (changes dated months earlier, routine-looking messages). The evidence lives in the repo's Activity tab, which shows the recent force push that rewrote history.

Preconditions / Affected

Attackers need a compromised maintainer GitHub account (observed via expired-domain takeover or another account-recovery path) and, to reach downstream registries, the registry publishing credentials. Where they lacked those, the compromise stayed on GitHub — Socket saw no malicious PyPI or npm releases in cases where credentials appeared unavailable. A tell for account takeover: multiple repos under one account modified in the same narrow window (the Xpos587 account had repos all changed June 23 at 10:00 UTC).

What to do

• Do not trust the GitHub file view or commit history. Review the Activity tab for force pushes, plus repository activity logs, package release metadata, VS Code task configuration, and suspicious changes to config files.
• If you installed an affected version, treat the environment as compromised: preserve forensic artifacts, rebuild from known-good lockfiles, rotate exposed secrets from a clean machine, and audit developer workstations and repositories for hidden execution paths.
• Do not assume a vendor's cleanup was complete — see caveat.

Caveats

Partial remediation is a real risk. When 7span (sevenspan namespace on Packagist) removed the fake .woff2 payloads, obfuscated JS hidden in configuration files remained. Cleanup targeting one hiding method misses the others the same campaign uses — hunt for every variant, not just the one you found first.