Loading malware…
PolinRider is a DPRK-linked software supply-chain malware campaign associated with the Lazarus Group and the broader Contagious Interview activity cluster. It targets software developers and maintainers by compromising legitimate source-code repositories and package publication workflows, especially in ecosystems where a Git repository directly serves as the published artifact. The operation has been observed across GitHub-hosted projects, Go modules, Packagist/Composer packages, npm packages, and browser-extension distribution, with a strong emphasis on developer-facing open-source projects and personal maintainer accounts.
PolinRider commonly injects obfuscated JavaScript loaders into trusted project files, particularly build and configuration files used by JavaScript toolchains, and has also concealed loaders inside fake font assets and Visual Studio Code task configurations. In some cases, malicious pull requests were used to place executable payloads into build-time configuration files so that routine developer actions such as building, previewing, or opening a project in an IDE trigger execution. The campaign has also used malicious dependencies and package releases, including decoy packages that retain legitimate functionality while executing a hidden loader at import time.
Once executed, the loader retrieves encrypted follow-on payloads through blockchain-based dead-drop infrastructure spanning multiple public chains, then decrypts and executes the recovered code in the local runtime. This architecture reduces reliance on conventional hosted payload servers and complicates disruption. Reported downstream payloads in the PolinRider chain include BeaverTail variants and the InvisibleFerret implant, also reported as DEV#POPPER RAT and OmniStealer. These payloads have been associated with credential theft, browser-data theft, cryptocurrency-wallet theft, remote command execution, and broader post-compromise control.
A notable operational characteristic is repository propagation and tampering concealment. PolinRider has been observed taking over legitimate GitHub accounts, modifying repositories already owned by the victim, appending malicious code to existing files, and rewriting Git history with force-pushed and backdated commits to make changes appear benign or older than they are. The campaign overlaps with TasksJacker tradecraft, including abuse of VS Code tasks configured to run automatically when a folder is opened, and some compromised repositories have contained artifacts from both clusters. Victimology and tradecraft indicate a focus on individual developers, including job-seeking developers, consistent with Lazarus operations that blend social engineering, developer tooling abuse, and supply-chain compromise.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"PolinRider Confirmed Footprint Grows 6.5x Since March" published by OpenSourceMalware.
OpenSourceMalware’s PolinRider reporting describes the same loader architecture as culminating in a DPRK BeaverTail variant and repository-propagation backdoor/infostealer behavior.
28 distinct techniques documented for this family, organized by ATT&CK tactic.
the malware still... spreads through the victims’ own GitHub accounts... Review your GitHub account for unauthorized pushes — the campaign spreads by pushing the payload back out through victim accounts.
"PolinRider Confirmed Footprint Grows 6.5x Since March" ... #SupplyChain, #GitHub, #ContagiousInterview, #PolinRider, #TasksJacker
Malicious npm dependencies (typosquats of tailwindcss-animate and friends) whose postinstall hooks do the config-file injection.
Audit persistence: SSH authorized_keys , crontabs, launchd agents (macOS), systemd services (Linux), and scheduled tasks (Windows).
The technique is .vscode/tasks.json with "runOn": "folderOpen" ... For trusted workspaces, that happens silently, before any code review ... Drop a tasks.json like that into a repository, get a developer to open the repository in VS Code, and you have remote code execution on their machine.
A Windows script rewrites git history to hide the tampering... temp_auto_push.bat still rewrites the latest commit... bypasses pre-commit hooks with --no-verify , and force-pushes to erase the evidence.
.vscode/tasks.json with a runOn: folderOpen trigger that curl-pipes a shell command the instant a victim opens the project.
injecting payloads into JavaScript config files that execute during builds but rarely receive scrutiny in code review
Audit persistence: SSH authorized_keys , crontabs, launchd agents (macOS), systemd services (Linux), and scheduled tasks (Windows).
Audit persistence: SSH authorized_keys , crontabs, launchd agents (macOS), systemd services (Linux), and scheduled tasks (Windows).
takes over legitimate GitHub accounts and quietly injects an obfuscated JavaScript loader into repositories...
JavaScript smuggled inside public/fonts/fa-solid-400.woff2 (a file no developer ever opens or reviews)
A Windows script rewrites git history to hide the tampering, making it look like a normal commit... temp_auto_push.bat still rewrites the latest commit to preserve its original timestamp... and force-pushes to erase the evidence.
the malware still... spreads through the victims’ own GitHub accounts... Review your GitHub account for unauthorized pushes — the campaign spreads by pushing the payload back out through victim accounts.
Every invocation of astro build, astro dev, or astro preview from the affected branch runs the file as a Node.js module, and an obfuscated IIFE at the end fires automatically.
It issues an HTTP GET to /$/boot with a spoofed Chrome 131 desktop User-Agent. The Sec-V header exfiltrates the marker value...
The payload hides in config files... then uses blockchain dead-drops to download the Lazarus stealer toolkit.
The loader still resolves its second stage from blockchain dead-drops across TRON, Aptos, and BNB Smart Chain, decrypts it with embedded XOR keys, and runs it through eval().
Stage A runs concurrently with Stage B. It resolves a second-stage command through a three-chain relay... The attacker updates the active payload by sending one new BSC transaction from a wallet they control. No DNS record changes, no IP address updates, no server restarts.
25 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named malware/tool discussed as the primary subject of the referenced post about its expanding footprint.
A Lazarus-linked supply-chain malware campaign targeting GitHub repositories by injecting obfuscated JavaScript payloads into build/config files and, increasingly, smuggling the same payload inside .woff2 font files. It spreads through compromised developer GitHub accounts and is aimed largely at individual job-seeking developers.
"PolinRider Jumps the Fence" published by OpenSourceMalware. #SupplyChain, #NPM, #PyPI, #VSCode, #PolinRider
A DPRK-linked supply-chain malware campaign that compromises legitimate GitHub accounts and injects obfuscated JavaScript loaders into repositories, config files, fake .woff2 font files, and VS Code tasks. It leverages repo-backed package ecosystems such as Go modules and Packagist to distribute malicious code, uses blockchain dead-drops for second-stage retrieval, and rewrites git history to hide tampering.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.