PolinRider: The North Korean Supply Chain Attack That Compromised 1,951 GitHub Repos

The PolinRider campaign represents one of the most aggressive and technically sophisticated open-source supply chain attacks ever attributed to North Korea. First flagged by OpenSourceMalware in March 2026, it has rapidly expanded across multiple package ecosystems and developer toolchains, compromising nearly 2,000 GitHub repositories and leveraging blockchain technology for command-and-control (C2) resilience .

Attribution and Campaign Identity

PolinRider is attributed to the Democratic People's Republic of Korea (DPRK) and aligned with the Lazarus Group. It operates as a sub-campaign within the broader Contagious Interview cluster (also tracked as Famous Chollima) . The campaign has operationally merged with the related TasksJacker campaign, which focuses on abusing VS Code task automation .

Scope and Scale

The scale of PolinRider is vast and growing rapidly:

• 1,951 compromised GitHub repositories belonging to 1,047 unique owners as of late April 2026
• The number of affected repositories roughly tripled in the five weeks following initial disclosure
• More than 1,700 malicious npm packages have been published as part of the broader Contagious Interview operation

Ecosystems Targeted

The campaign has spread far beyond npm, its initial vector:

• npm (Node.js): The primary target, with hundreds of malicious packages including dev-log-core, logger-base, logkitx, pino-debugger, debug-fmt, and debug-glit
• PyPI (Python): Python packages distributed as part of the Contagious Interview operation
• Go (Go Module Mirror): Malicious Go packages identified by Socket Security
• Packagist (PHP/Composer): Expanded into this ecosystem by July 2026

The campaign also compromised the widely used Axios npm library (versions 1.14.1 and 0.30.0) in April 2026 via a malicious dependency named plain-crypto-js, affecting roughly 100 million weekly downloads .

The Multi-Stage Infection Technique

The PolinRider infection chain is a carefully orchestrated, four-stage process designed to maximize stealth and minimize the need for victim interaction.

Stage 1: Obfuscated JavaScript Loaders in Config Files

Attackers append heavily obfuscated JavaScript to the end of legitimate developer configuration files such as postcss.config.mjs, tailwind.config.js, eslint.config.mjs, and next.config.mjs . The malicious lines are padded with excess whitespace, pushing the code beyond the default IDE viewing width and making it invisible during casual code review .

Stage 2: Sophisticated Concealment Methods

PolinRider employs three primary concealment techniques:

• Fake .woff2 font files: The obfuscated JavaScript is disguised as a web font file, a binary format most developers never inspect
• Whitespace padding: Executable lines are padded far to the right of the visible viewport
• Git history falsification (ForceMemo): A module that rewrites Git history, backdating malicious commits by months to appear as routine maintenance from legitimate maintainers

Stage 3: VS Code Task Execution (TasksJacker)

Malicious .vscode/tasks.json files are injected into repositories. When a developer clones a compromised repo and opens it in VS Code, the task executes automatically with no further user interaction. This bypasses the social engineering step used in earlier Contagious Interview campaigns entirely .

Stage 4: Blockchain-Based Payload Retrieval (C2)

The deobfuscated JavaScript loader retrieves its next-stage payload by reading encrypted data embedded in cryptocurrency blockchain transactions. The campaign uses TRON, Aptos, and BSC (BNB Smart Chain) blockchain networks as dead-drop C2 channels . This "etherhiding" technique makes takedown extremely difficult since the C2 data exists immutably on public blockchains.

Malware Payloads Delivered

PolinRider delivers a suite of malicious payloads, each with specific capabilities:

BeaverTail (JavaScript-based Dropper/Infostealer)

The primary malware family delivered is a new variant of BeaverTail, a known JavaScript-based malware associated with DPRK operations. It acts as a first-stage dropper and credential harvester .

DEV#POPPER.js (Remote Access Trojan)

The infection chain delivers a JavaScript-based RAT tracked as DEV#POPPER.js. It provides full remote code execution (RCE), persistent access, and the ability to execute arbitrary commands on the compromised developer workstation. eSentire's Threat Response Unit (TRU) detected it in the wild targeting the Energy, Utilities, and Waste sector in February 2026 .

OmniStealer (Information Stealer)

Deployed alongside DEV#POPPER, OmniStealer aggressively targets cryptocurrency wallet credentials, private keys, browser-stored credentials, session tokens, API keys, and CI/CD secrets .

Other Payloads

• PylangGhost: A Python-based backdoor, marking the first time this malware was propagated via npm packages
• Socket.io backdoor: Establishes persistent reverse-shell communication with attacker infrastructure

Connection to Contagious Interview

PolinRider is a direct operational evolution of the Contagious Interview campaign. While Contagious Interview historically relied on fake job interview lures and social engineering to trick developers into installing trojanized projects, PolinRider represents a shift toward fully automated, social-engineering-free supply chain compromise .

Key differences and overlaps include:

• Both campaigns share the same BeaverTail malware family and overlapping C2 infrastructure
• PolinRider/TasksJacker eliminates the social layer entirely — compromise happens automatically via malicious packages and VS Code auto-run tasks
• Both use blockchain-based payload retrieval

Recommended Defensive Response

Based on guidance from OpenSourceMalware, Socket Security, Sonatype, and other researchers, organizations should take the following steps:

Immediate Actions

1. Treat any affected environment as fully compromised — assume credential and secret theft until proven otherwise
2. Remove affected packages from package.json, go.mod, and lockfiles
3. Review all outbound network activity from developer workstations, especially connections to blockchain nodes and unknown IPs
4. Pause work on any codebase that ran an affected package — revert to commits from before the known compromise window

Code and Repository Cleanup

6. Scan all postcss.config.mjs, tailwind.config.js, eslint.config.mjs, next.config.mjs and similar files for appended obfuscated JavaScript
7. Inspect .vscode/ directories for unexpected tasks.json with auto-run configurations
8. Review .woff2 and other binary asset files for embedded JavaScript

Long-Term Hardening

10. Implement egress filtering on developer networks to restrict outbound connections
11. Use package integrity verification (lockfiles, checksum validation,

    npm audit

    , socket.dev scanning) before installation
12. Disable VS Code auto-run tasks in development environments where not explicitly needed
13. Deploy static analysis rules — Datadog offers a dedicated PolinRider detection rule for JavaScript/Node.js code security scanning
14. Monitor for blockchain-based C2 indicators — unusual DNS lookups to blockchain APIs or non-standard outbound connections on developer machines