OmniStealer

temp_auto_push.bat , the script behind the GitHub and Go compromises, runs locally on the infected machine using the developer's own already-authorized git credentials.

“Victim receives a fake job offer via Telegram, pointing to a GitHub repo or trojanized NPM package.”

DPRK’s goal is to compromise developer machines and accounts to silently propagate malicious code, clone repositories, and push backdoored commits without active human intervention.

T1195.002 — Compromise Software Supply Chain (Initial Access)

“Victim receives a fake job offer via Telegram, pointing to a GitHub repo or trojanized NPM package.”

PolinRider has spent at least five months getting into thousands of developer machines any way it can: fake interviews, poisoned forks, malicious VS Code tasks, typosquatted packages.

“[The HTTP stager] acted as a Python dropper: it installed Python silently on the victim's machine, then used it to fetch ... the OmniStealer payload.”

the payload dropped into each module is DPRK's obfuscated JavaScript loader. It resolves a second-stage payload from blockchain RPC infrastructure ... decrypts it with an embedded XOR key, and executes it with eval()

A committed .vscode/tasks.json with runOptions.runOn: 'folderOpen' executes the moment the project folder opens in VS Code, Cursor, Antigravity, or GitHub Desktop, bypassing npm v12's lifecycle-script protections entirely.

temp_auto_push.bat , the script behind the GitHub and Go compromises, runs locally on the infected machine using the developer's own already-authorized git credentials.

In each case, a malicious version was published under the package owner’s identity but without their consent.

temp_auto_push.bat , the script behind the GitHub and Go compromises, runs locally on the infected machine using the developer's own already-authorized git credentials.

“The initial loader checks transactions on TRON ... to locate encrypted JavaScript stored in BNB Smart Chain transactions.”

public/fonts/fa-solid-400.woff2 isn't a font. It's JavaScript that reads XOR-encrypted payloads from on-chain transactions

temp_auto_push.bat , the script behind the GitHub and Go compromises, runs locally on the infected machine using the developer's own already-authorized git credentials.

A committed .vscode/tasks.json with runOptions.runOn: 'folderOpen' executes the moment the project folder opens in VS Code, Cursor, Antigravity, or GitHub Desktop, bypassing npm v12's lifecycle-script protections entirely.

decrypts it with an embedded XOR key, and executes it with eval() for remote code execution and persistence through detached background processes.

In each case, a malicious version was published under the package owner’s identity but without their consent.

“Access to lsass is observed, and a second YARA rule fires for an XFiles and OmniStealer style information stealer.”

The follow-on payloads are the familiar Lazarus toolkit: DEV#POPPER, OmniStealer, and InvisibleFerret, covering credential theft, browser-data theft, crypto-wallet exfiltration, and keylogging.

covering credential theft, browser-data theft, crypto-wallet exfiltration, and keylogging.

“A separate one-time stealer seeks browser information, password manager data, cloud storage credentials and cryptocurrency wallet material.”

In each case, a malicious version was published under the package owner’s identity but without their consent.

Once the malware has harvested a maintainer's ~/.npmrc token, it either publishes directly, or it simply waits and lets the maintainer's own next npm publish carry the payload along.

The follow-on payloads are the familiar Lazarus toolkit: DEV#POPPER, OmniStealer, and InvisibleFerret, covering credential theft, browser-data theft, crypto-wallet exfiltration, and keylogging.

“pip installs requests, pyperclip, mss, and Pillow, the toolkit for clipboard theft, screen capture, and HTTP exfiltration.”

“pip installs … pyperclip … the toolkit for clipboard theft” and “ClipboardMonitor.”

novel tradecraft such as Cross-Chain TxDataHiding techniques combined with the subsequent creation of a takedown-proof Command and control (C2) infrastructure

a multi-layered attack leveraging novel blockchain-based command-and-control infrastructure

“C2 path /init Port 443 endpoint returning the RAT and scanner” and “C2 path /boot Port 443 Ethereum recovery endpoint.”

“The malware queries a TRON wallet ... with Aptos as a fallback,” retrieves encrypted JavaScript from BSC transaction calldata, and “_Z scans Ethereum mainnet” through public RPC services.

“The server then supplies code that can rebuild the infection.”

“The stealer begins POSTing host data to 150.251.113[.]223:8443” and the indicator labels the host “Stealer exfil.”

“Researchers counted 153 wallet targets and said stolen data leaves through a messaging bot interface.”