Loading story…
A malicious pull request against the Egonex-AI/Understand-Anything GitHub repository inserted an obfuscated payload into homepage/astro.config.mjs, abusing Astro’s automatic execution of that file during development, build, and preview workflows. SafeDep reported that the PR, presented as a harmless dashboard bug fix, actually changed only .gitignore and astro.config.mjs, with the malicious code concealed behind extensive horizontal whitespace to reduce visibility in GitHub’s diff view. The payload restored require in an ES module context, contacted one of three hardcoded command-and-control servers, exfiltrated a campaign marker, decrypted and executed a downloaded bot client, and fetched a second-stage command through a Tron-to-Aptos-to-BSC blockchain relay.
The attack was disclosed publicly in issue #432 and attributed by SafeDep to the DPRK-linked PolinRider campaign based on matching cryptographic and infrastructure fingerprints, a link later amplified in threat-intelligence social media reporting. SafeDep said the intrusion fits its malicious pull request threat model, in which attackers compromise upstream repositories through contributor PRs rather than poisoned dependencies, and warned that any environment that ran Astro commands from the affected branch should be treated as compromised. Recommended response actions include rotating credentials, reviewing network logs, and hunting for suspicious createRequire, outbound network access, or eval behavior inside build configuration files.
Trace attribution and downstream blast radius.
4 events from the most recent confirmed update back to the earliest known activity.
A Bluesky post by the account lazarusholic shared the SafeDep publication and associated it with the hashtags #PolinRider, #DPRK, and #CTI. The post served as social amplification of the reported attribution and attack details.
SafeDep published a report detailing the astro.config.mjs supply chain attack, including blockchain-relayed C2 behavior and build-time payload execution. The report attributes the activity to the DPRK-linked PolinRider campaign based on matching cryptographic and infrastructure fingerprints.
The attack was publicly disclosed in issue #432. The disclosure identified the PR-based supply chain compromise involving astro.config.mjs and its build-time payload behavior.
A malicious pull request, #206, was submitted to the Egonex-AI/Understand-Anything GitHub repository. It inserted an obfuscated payload into homepage/astro.config.mjs and modified .gitignore while masquerading as a benign dashboard bug fix.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the `prt-scan` campaign abused misconfigured GitHub Actions workflows using the `pull_request_target` trigger to run attacker-controlled code from forked pull requests in privileged CI contexts. The actor used at least six GitHub accounts to submit more than 500 malicious pull requests across six waves, disguising many as routine CI updates and tailoring payloads to Python, Node.js, Go, Rust, and GitHub Actions repositories. Wiz said the operation evolved from simple bash payloads into AI-assisted, repository-aware implants designed to steal `GITHUB_TOKEN` values, enumerate secrets, probe cloud metadata services, and exfiltrate credentials through workflow logs and pull request comments. The campaign succeeded often enough to cause real supply-chain impact despite an estimated success rate below 10%. Wiz confirmed compromise of the npm packages **`@codfish/eslint-config`** and **`@codfish/actions`** across 106 versions, and verified theft of AWS keys, Cloudflare API tokens, and Netlify authentication tokens. High-profile projects including Sentry, OpenSearch, IPFS, NixOS, Jina AI, and recharts reportedly blocked the attempts through contributor approval gates and workflow restrictions. The activity follows earlier warnings from Sysdig that insecure use of `pull_request_target` in prominent repositories such as MITRE, Splunk, and Spotipy could expose secrets and high-privilege `GITHUB_TOKEN` permissions, underscoring that unsafe GitHub Actions defaults remain an active software supply-chain risk.
Jun 29, 2026
A report from OpenSource Malware says the DPRK-linked **PolinRider** campaign compromised legitimate GitHub maintainer accounts and used them to publish malicious npm releases, highlighting a case involving developer **DiogoAngelim** and the packages `fetch-page-assets` and `html-to-gutenberg`. The report says `fetch-page-assets` version `1.2.9` was identified and removed under advisory `GHSA-vxq2-vhm7-7mhq`, but attackers continued publishing malicious versions `1.2.10` through `1.2.14`, with payloads tied to **PolinRider/NullReceiver** concealed in files including `.vscode/tasks.json`, a fake `.woff2` font, and later `babel.config.cjs`. The article says the compromise extended beyond a single package: all seven non-archived public repositories under the maintainer’s account were allegedly reinfected in coordinated force-push waves, indicating sustained attacker control over both the GitHub account and build environment. OpenSource Malware estimates the campaign has reached **4,367 repositories across 2,152 owners** and argues that current GitHub and npm response mechanisms, which focus on removing specific malicious versions, are insufficient when attackers retain control of trusted maintainer accounts and can repeatedly ship new poisoned releases.
Aug 25, 2026
A supply-chain compromise in the `react-tracked` GitHub repository led to attacker-controlled code execution during `npm install` after malicious commits briefly landed on the default branch. The implant added `src/install.js` and a `postinstall` hook that fetched and evaluated a remote JavaScript payload from an attacker-controlled HTTPS endpoint, disabled TLS verification, and avoided CI and cloud or serverless environments to focus on developer workstations. Although the tainted code was never published to npm and was later force-pushed away, any developer who installed from an affected checkout, fork, local clone, or direct commit reference may have been exposed; impacted systems should be treated as fully compromised and reachable credentials rotated. The incident fits a broader wave of developer-focused software supply-chain attacks that has intensified across GitHub, npm, PyPI, Docker Hub, and CI/CD environments. Recent reporting tied the March 2026 compromises of tools including Trivy, Checkmarx KICS, and LiteLLM to TeamPCP, a threat cluster Oligo Security says overlaps with the longer-running TA-NATALSTATUS and ShadowRay 2.0 activity through shared infrastructure, staging paths, and deployment scripts. Researchers say these campaigns increasingly abuse trusted developer platforms, steal tokens, and use malicious repositories, workflows, and packages to reach workstations and cloud-connected build environments.
Aug 12, 2026