# North Korean Hackers Flood Software Ecosystems With 108 Malicious Packages in Escalating PolinRider Campaign


A sophisticated North Korean threat actor group is waging an increasingly aggressive campaign to compromise developers through poisoned software packages and browser extensions, exploiting trust within open-source ecosystems to distribute sophisticated remote access malware. New analysis reveals that attackers have successfully published 108 unique malicious packages across four major development platforms—npm, Packagist, Go, and Google Chrome—marking a significant expansion of an operation that has already compromised nearly 2,000 public GitHub repositories.


The campaign, tracked as PolinRider, is the latest evolution of the Contagious Interview threat group, a North Korea-aligned operation that combines social engineering prowess with technical sophistication to target software developers and cryptocurrency sector workers. Security researchers warn that the threat remains active and mounting, with new malicious packages likely to continue appearing as attackers refine their account takeover techniques and expand their distribution network.


## The Threat: A Poison Pill for Development Workflows


The scope of the PolinRider campaign underscores a fundamental vulnerability in how modern software development operates. Researchers at Socket have documented 162 malicious release artifacts spanning 108 unique packages:


| Platform | Package Count | Details |

|----------|---------------|---------|

| npm | 19 libraries | JavaScript ecosystem targeting |

| Composer | 10 packages | PHP development supply chain |

| Go | 61 modules | Go language ecosystem compromise |

| Chrome Web Store | 1 extension | Browser-level access |


The malicious packages don't announce themselves. They arrive disguised as legitimate libraries or as updates to existing projects, often making their way into developer environments through normal dependency resolution processes. Once installed, they begin searching for configuration files critical to the build pipeline—including PostCSS, Tailwind, ESLint, Babel, and Next.js config files—and inject malicious JavaScript that executes during development workflows.


"The threat actors use Git history rewriting, including force pushes and anti-dated commits to make malicious changes appear older and less suspicious," said Karlo Zanki, security researcher at Socket. This technique is particularly insidious because it allows attackers to embed malware that appears to have been part of a project's legitimate history, evading casual code reviews.


## Background and Context: The Contagious Interview Campaign


The Contagious Interview operation has been active since at least 2023, and PolinRider represents its most ambitious supply-chain pivot to date. Rather than relying solely on social engineering to trick individual developers into running malware, the group now operates at the ecosystem level, poisoning packages that thousands of developers may unknowingly download.


### How Developers Become Targets


The campaign's initial attack vector remains devastatingly effective:


  • Fake recruiters impersonate hiring managers or collaborators on LinkedIn, GitHub, and freelance job boards
  • Elaborate fronts feature AI-generated employee profiles and convincing company websites
  • Technical interviews include coding assessments rigged to deliver malware when executed
  • Trojanized tools introduce malicious VS Code extensions or npm packages into the developer's environment

  • Once the initial compromise is achieved, the real attack begins: attackers take over maintainer accounts and begin publishing poisoned versions of legitimate open-source libraries.


    ### Scale of Compromise


    As of April 2026, the operation had:

  • Compromised 1,951 public GitHub repositories from 1,047 unique owners
  • Merged with another threat cluster called TaskJacker, which plants malicious VS Code task files
  • Continued expanding with new malicious packages appearing regularly

  • ## Technical Details: From Injection to Exfiltration


    ### The Attack Chain


    The PolinRider infrastructure operates through a sophisticated multi-stage process:


    Stage 1: Obfuscated Loader

    Malicious JavaScript code is embedded within legitimate repositories and package files. The code is heavily obfuscated and often concealed through:

  • Whitespace padding that hides the payload in plain sight
  • Fake .woff2 font files that contain embedded malicious code
  • VS Code task files configured to trigger on folder open (runOn: 'folderOpen')

  • Stage 2: Execution Trigger

    When a developer opens a compromised project in VS Code or similar IDEs, the malicious tasks execute automatically. The VS Code method is particularly effective because it operates within a trusted development environment where many security controls are disabled.


    Stage 3: Repository Modification

    The malware injects code into configuration files used during build processes. A Windows batch script—with equivalent tools suspected for Linux and macOS—modifies commits to appear as though they were made by the original author. This technique obscures the malicious additions in Git history.


    Stage 4: Payload Retrieval

    The loader reaches out to blockchain infrastructure services to retrieve encrypted payloads:

  • TRON network
  • Aptos network
  • BNB Smart Chain

  • This blockchain-based command-and-control approach helps the attackers evade traditional network security controls.


    Stage 5: Final Malware Delivery

    Once decrypted, the second-stage payload deploys two sophisticated tools:

  • DEV#POPPER RAT — a remote access trojan enabling full machine control
  • OmniStealer — information stealer designed to exfiltrate sensitive data

  • For developers in the cryptocurrency sector, this final stage is particularly catastrophic, as OmniStealer specifically targets wallet credentials and authentication tokens.


    ### The Account Takeover Method


    Researchers note that attackers are not using stolen credentials in the traditional sense. Instead, they're exploiting account recovery mechanisms through:

  • Expired domain takeovers associated with old maintainer accounts
  • Alternative recovery paths that may include social engineering of support staff
  • Compromised maintainer environments where the developers themselves have already been infected

  • Once they gain access to a maintainer account, they can publish new versions of legitimate packages, merge malicious code into existing projects, or create entirely new packages that mimic popular libraries with slight naming variations.


    ## Implications: The Supply Chain at Risk


    ### Who Should Be Concerned


  • JavaScript/Node.js developers using npm dependencies
  • PHP developers relying on Composer packages
  • Go developers importing modules from public registries
  • Chrome extension users who may have installed trojanized extensions
  • Cryptocurrency developers and traders who are specifically targeted
  • Any organization that uses open-source packages without strict verification

  • ### The Broader Risk


    This campaign represents a fundamental challenge to software supply chain security. Unlike traditional malware that attacks end users, PolinRider infects the *development environment itself*. Code that appears safe during review can execute malicious commands during normal build processes, inserting harmful code into applications before they're even compiled.


    For cryptocurrency sector workers, the risk is amplified: attackers can steal private keys, wallet credentials, and seed phrases during development, leading to direct financial theft.


    ## Recommendations: Defending Against PolinRider


    ### For Individual Developers


  • Audit VS Code extensions ruthlessly—disable any that aren't essential and verify publisher legitimacy
  • Pin dependency versions rather than using floating versions that automatically pull updates
  • Review package changelogs before updating, especially for lesser-known libraries
  • Use private npm registries or mirrors that cache packages and add verification steps
  • Enable two-factor authentication on all development platform accounts (GitHub, npm, etc.)
  • Monitor your GitHub for unexpected commits, forks, or repository modifications

  • ### For Organizations


  • Implement software composition analysis (SCA) tools that scan for known malicious packages
  • Require code review of dependency updates, not just automated merges
  • Isolate development networks from production systems
  • Monitor Git history for signs of manipulation or anti-dated commits
  • Block high-risk registries if your organization doesn't require them
  • Mandate security training focused on social engineering tactics used in Contagious Interview
  • Verify package publishers directly rather than assuming registry trust

  • ### For Package Registry Operators


  • Implement stricter account recovery policies
  • Flag bulk package uploads from previously dormant accounts
  • Monitor for Git history rewrites on repositories
  • Require publisher verification before allowing package publication

  • ---


    ## HackWire Analysis


    PolinRider exposes a critical blind spot in how the tech industry manages security: we've built our entire development pipeline on a foundation of trust that was never warranted. The open-source ecosystem—which powers everything from banking systems to space agencies—has operated on the principle that code published to npm, Packagist, or Go registries has been vetted. It hasn't.


    What makes this campaign particularly dangerous is its timing and sophistication. Contagious Interview has been refining social engineering techniques for nearly four years, learning exactly how to build trust with developers. They've watched how developers think, how they verify authenticity, how they rationalize downloading code from strangers. Now they're weaponizing that knowledge at scale.


    The blockchain-based command-and-control infrastructure is especially telling. It's not sophisticated for its own sake—it's sophisticated because traditional network monitoring can't easily track activity to public blockchain nodes. TRON, Aptos, and BNB Smart Chain are designed for financial transactions, making them ideal cover for malicious communications.


    The cherry-picking of build configuration files reveals deep understanding of the development workflow. Tailwind, ESLint, Babel, PostCSS, Next.js—these are files that *every* developer touches, usually without reading them closely. They're part of infrastructure, not application code. Injecting malicious JavaScript into tailwind.config.js is brilliant because it loads early, executes with high privileges, and looks utterly routine in dependency trees.


    For defenders, there's no single mitigation. This requires changes at multiple levels: developers need to treat their development environment as a production security asset, organizations need to implement supply-chain verification, and platform operators need to make account takeovers exponentially harder. Until those changes happen systematically, attacks like PolinRider will continue expanding.


    HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Tools](https://www.hackwire.news/category/tools) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)