North Korean threat actors keep finding ways into your dependencies. The latest: 108 malicious packages and browser extensions spanning npm, Packagist, Go modules, and Google Chrome.
Security researchers at Socket call this campaign PolinRider. It’s tied to the same crew behind Contagious Interview — the fake job recruitment scheme that targets developers with malicious code disguised as coding assessments.
The attack works like this. Attackers compromise maintainer accounts, modify legitimate repos, and publish infected package versions. They drop obfuscated JavaScript payloads into GitHub repos — hidden in whitespace padding or fake .woff2 font files. The code triggers through developer tooling like VS Code task files set to run on folder open.
As of April 2026, this activity had compromised 1,951 GitHub repos tied to 1,047 unique owners. The attackers aren’t using stolen GitHub credentials. They’re taking over maintainer accounts — likely through expired domain takeover or account recovery exploits.
Once executed, the malware hunts for config files like postcss.config.mjs, tailwind.config.js, and eslint.config.mjs, then appends malicious JS code to them. A Windows batch script stealthily rewrites Git history to make malicious commits look like the original author did them. Similar tooling exists for Linux and macOS.
The payload reaches out to blockchain infrastructure — TRON, Aptos, and BNB Smart Chain — to fetch an encrypted second stage that unpacks to DEV#POPPER RAT and OmniStealer.
Socket’s Karlo Zanki says defenders can’t trust what they see on GitHub landing pages anymore. “Review repository activity logs, package release metadata, VS Code task configuration, and suspicious changes to configuration files.”
If you’ve installed any of these packages, treat the environment as compromised. Rotate secrets from a clean machine. Rebuild from a known good lockfile. Audit workstations and repos for hidden execution paths or suspicious changes to .vscode/tasks.json, config.js, vite.config.js, and eslint.config.js.
