🕵️ PolinRider

The items that name it 40

• Binance hack: how a compromised developer laptop can lead to a $6.3 billion breach
  articleas threat actors2026-10-30It is written here as PolinRider (campaign researchers link to North Korea; hides scrambled code in project config files and can run when a project is opened in VS Code).

  campaign researchers link to North Korea; hides scrambled code in project config files and can run when a project is opened in VS Code

• Earliest Known PolinRider Malware Found in 2025 npm Packages
  writeupas threat actors2026-10-30It is written here as PolinRider (campaign; earliest known sample found in npm packages published May 4, 2025, eight months before the first documented victims in January 2026).

  campaign; earliest known sample found in npm packages published May 4, 2025, eight months before the first documented victims in January 2026

• Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles
  writeupas classification.key entities2026-10-25
• The OpenSourceMalware Show #26
  talkas classification.key entities2026-10-21
• Glassworm Hacks OVH Clouds CLI tool
  writeupas classification.key entities2026-10-19
• GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font File
  writeupas classification.key entities2026-10-16
• The OpenSourceMalware Show #25
  talkas threat actors2026-10-15It is written here as PolinRider (campaign involving suspicious, forged-looking changes to code in repositories).

  campaign involving suspicious, forged-looking changes to code in repositories

• Evolution of Web3 in Cloud Supply Chain Attacks
  articleas classification.key entities2026-10-07
• How to Investigate a GitHub Repo's Real History
  writeupas threat actors2026-10-06

  DPRK-linked campaign that uses a Windows batch script (e.g. temp_auto_push.bat) to roll back a machine's clock, swap local git identity, fold a malicious change into an existing commit, and force-push the result to hide tampering. Case study: compromised nestjsx/nest-access-control via account micha

• The OpenSourceMalware Show #23
  talkas threat actors2026-10-02

  DPRK campaign using a fake font file (originally fa-solid-400.woff2) as an auto-run payload via VS Code tasks.json; evolved from the 'TasksJacker' campaign first documented November of the prior year. Over 127 variants found on public GitHub using an .llf extension as of this report, with over 10,00

• PolinRider is A/B Testing its Way Past Your Detections
  writeupas threat actors2026-09-26

  Malware family using the tasks.json / fake .woff2 font file trick to autorun payloads when a VS Code folder opens; observed running multiple concurrent variants (400, 500, 900) as apparent A/B tests.

• The OpenSourceMalware Show #22
  talkas threat actors2026-09-25

  Malware described as part of the evolution of the Contagious Interview campaign; found embedded in public (and suspected private) GitHub, and reportedly Bitbucket, repositories; victims have been observed infecting other people.

• npm Supply-Chain Attack Abuses Trusted Publishing to Ship GHAPPIER Loader
  articleas threat actors2026-09-22

  DPRK-linked campaign tracked since March 2026 that uses Ethereum blockchain transactions for command-and-control configuration, found as a second payload in another victim's repository.

• Socket: Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan
  writeupas threat actors2026-09-20

  Malware/loader family; loader has PolinRider-family indicators including multi-chain resolver structure, global markers, and XOR keys, matching the blockchain loader analyzed in Socket's PHP supply-chain investigation.

• PolinRider Spreads Through Compromised GitHub Accounts and Packagist
  articleas threat actors2026-09-17

  Ongoing supply-chain malware campaign, described as North Korea-linked, distributing malware across npm, PyPI, Go modules, Packagist, and Chrome extensions via compromised developer accounts and Git repositories; primary objective appears to be cryptocurrency theft, with broader information-stealing

• WeaselBiscuit Strips BeaverTail and OtterCookie Down to Essentials
  writeupas threat actors2026-09-17

  Cluster referenced for its numeric per-install campaign-marker convention, which the WeaselBiscuit campaign identifiers (10, 12, 44, 79, 95, 99) are said to mirror.

• The OpenSourceMalware Show #21
  talkas classification.key entities2026-09-17
• The OpenSourceMalware Show #20
  talkas classification.key entities2026-09-09
• The OpenSourceMalware Show #19
  talkas classification.key entities2026-08-28
• NPM Isn't Prepared For North Korean PolinRider Attack
  writeupas threat actors2026-08-25

  North Korean (DPRK) supply-chain campaign that compromises legitimate GitHub developer accounts and build environments, then weaponizes their npm/Go/PHP packages to distribute malware. Confirmed footprint of 4,367 repositories across 2,152 unique owners as of the July hunt (a 6.5x increase since Mar

• The OpenSourceMalware Show #18
  talkas classification.key entities2026-08-21
• The OpenSourceMalware Show #17
  talkas threat actors2026-08-14
• The OpenSourceMalware Show #15
  talkas threat actors2026-07-31

  Malware/automation tooling linked to DPRK that performs automatic credential harvesting from infected developer machines (via poisoned VS Code tasks.json), leading to account takeovers of npm and Go packages without deliberate targeting; examined by OSM research across 20 npm and Go packages, and by

• PolinRider Caused Dozens of npm, Go, PHP Compromises
  writeupas threat actors2026-07-31

  DPRK (North Korean) threat actor/campaign active for at least five months; compromises developer machines and accounts via fake interviews, poisoned forks, malicious VS Code tasks, and typosquatted packages, then auto-propagates malware into repos and packages the victim already has access to (not t

• NPM Implements Pre-Publication Malware Scanning, But Will It Work?
  articleas threat actors2026-07-31

  Campaign tracked by OpenSourceMalware attributed to DPRK tradecraft; malicious artifact frequently isn't in the npm tarball itself but in the repo, e.g. in tasks.json or a VS Code settings file

• The OpenSourceMalware Show #14
  talkas threat actors2026-07-23

  North Korean (Lazarus Group) campaign described as a 'human botnet' with persistence on thousands/tens of thousands of developer machines (via fake recruiters or consuming poisoned open-source packages), used for supply-chain compromise; linked via research published by Jenn Gile.

• OpenSourceMalware Blog
  articleas threat actors2026-07-18

  DPRK-linked malware/campaign; uses A/B testing to evade detections, has persistence mechanisms that defeat remediation attempts, shows infrastructure overlap with other DPRK activity.

• ChainVeil and ViteVenom are DPRK’s PolinRider Campaign
  writeupas threat actors2026-07-17

  Massively successful Lazarus Group (North Korean state-sponsored) campaign that emerged in early 2026; weaponized credentials stolen by TasksJacker; considered a parallel or sub-campaign to Contagious Interview; pioneered cryptowallet multiplexing using TRON, Aptos, and Binance Smart Chain. First re

• The OpenSourceMalware Show #13
  talkas threat actors2026-07-16

  North Korean state-sponsored campaign discovered in March 2026 (per episode, 'earlier this year'); weaponizes credentials stolen via developer compromise; found 2,417 newly-compromised repositories in new research, bringing total to over 4,400; considered a parallel/sub-campaign to Contagious Interv

• PolinRider Confirmed Footprint Grows 6.5x Since March
  writeupas threat actors2026-07-15

  Lazarus Group (North Korean state-sponsored) campaign that emerged in 2026; forks popular open source projects and submits malicious pull requests injecting payloads into JavaScript config files that execute during builds but rarely receive scrutiny in code review. Confirmed footprint grew from 675

• The OpenSourceMalware Show #12
  talkas threat actors2026-07-09

  North Korea (Lazarus Group) automated repo-hijacking campaign; a spin-off of Contagious Interview focused on taking over GitHub repositories; discussed as having spread into Go (Go registry) and PHP (Packagist) ecosystems without additional effort by the threat actors, since those registries ship pa

• PolinRider Jumps the Fence to Go, Packagist, npm, PyPI
  writeupas threat actors2026-07-08

  DPRK-linked supply-chain campaign, part of the Lazarus Group / Contagious Interview activity cluster; takes over legitimate GitHub accounts and injects an obfuscated JavaScript loader into repos the maintainer already owns; spread from GitHub to Go, Packagist, npm, and PyPI ecosystems without changi

• Socket: PolinRider
  writeupas threat actors2026-07-02

  Supply chain campaign linked to North Korean threat actors, expanding across npm, Packagist, Go modules, and Chrome extensions using hidden JavaScript loaders in developer environments

• OpenSource Malware: Active Malware Campaigns in January-May 2026
  writeupas classification.key entities2026-06-12
• The OpenSourceMalware Show #8
  talkas classification.key entities2026-06-11
• Active Malware Campaigns in January-May 2026
  writeupas classification.key entities2026-06-08
• The OpenSourceMalware Show #7
  talkas classification.key entities2026-06-03
• Socket: Famous Chollima Targets PHP Developers via Compromised Packagist Package
  writeupas classification.key entities2026-06-01
• Open Source Malware Podcast — episodes
  otheras threat actors2026-05-22

  DPRK-linked research subject; described as North Korea's automated repo-hijacking campaign spreading into Go and PHP ecosystems; has persistence mechanisms that defeat remediation attempts

• VSCode Lifecycle Script Malware
  writeupas threat actors2026-05-16

  Further evolution of TasksJacker targeting projects with over one million combined GitHub stars; carried a payload (via tailwind-autoanimation package) in index.js rather than a lifecycle hook