PolinRider Malware Inserted Into Packagist Dev Branches via Compromised GitHub Org

PolinRider operators compromised the Visanduma GitHub organization and implanted malware in four development branches of the Packagist package visanduma/nova-two-factor, which has more than 700,000 cumulative downloads. The malicious code was present in dev-* branches, including dev-main; Socket reported no compromised stable release, limiting known exposure primarily to users resolving development branches.

The campaign spreads through compromised developer accounts and repositories, with malicious files capable of executing when a developer opens an affected repository in a compatible IDE or runs standard build and test workflows. It uses rewritten Git history, concealed JavaScript, EtherHiding or NullReceiver dead-drop C2 resolution, and staged infostealer delivery; a newer variant invokes obfuscated JavaScript from PHP through shell_exec. Organizations that executed affected repositories should investigate potential endpoint compromise, reimage systems where warranted, rotate credentials, and review Git history, account activity, and automated IDE and build execution paths.