PolinRider Campaign Hijacked GitHub Maintainer Accounts to Push Malware to npm

A report from OpenSource Malware says the DPRK-linked PolinRider campaign compromised legitimate GitHub maintainer accounts and used them to publish malicious npm releases, highlighting a case involving developer DiogoAngelim and the packages fetch-page-assets and html-to-gutenberg. The report says fetch-page-assets version 1.2.9 was identified and removed under advisory GHSA-vxq2-vhm7-7mhq, but attackers continued publishing malicious versions 1.2.10 through 1.2.14, with payloads tied to PolinRider/NullReceiver concealed in files including .vscode/tasks.json, a fake .woff2 font, and later babel.config.cjs.

The article says the compromise extended beyond a single package: all seven non-archived public repositories under the maintainer’s account were allegedly reinfected in coordinated force-push waves, indicating sustained attacker control over both the GitHub account and build environment. OpenSource Malware estimates the campaign has reached 4,367 repositories across 2,152 owners and argues that current GitHub and npm response mechanisms, which focus on removing specific malicious versions, are insufficient when attackers retain control of trusted maintainer accounts and can repeatedly ship new poisoned releases.