Loading story…
PolinRider operators compromised the Visanduma GitHub organization and implanted malware in four development branches of the Packagist package visanduma/nova-two-factor, which has more than 700,000 cumulative downloads. The malicious code was present in dev-* branches, including dev-main; Socket reported no compromised stable release, limiting known exposure primarily to users resolving development branches.
The campaign spreads through compromised developer accounts and repositories, with malicious files capable of executing when a developer opens an affected repository in a compatible IDE or runs standard build and test workflows. It uses rewritten Git history, concealed JavaScript, EtherHiding or NullReceiver dead-drop C2 resolution, and staged infostealer delivery; a newer variant invokes obfuscated JavaScript from PHP through shell_exec. Organizations that executed affected repositories should investigate potential endpoint compromise, reimage systems where warranted, rotate credentials, and review Git history, account activity, and automated IDE and build execution paths.
Trace attribution and downstream blast radius.
3 events from the most recent confirmed update back to the earliest known activity.
The lazarusholic Bluesky account shared Socket's report describing PolinRider spreading through compromised GitHub accounts and the Packagist ecosystem, and associated the activity with EtherHiding, VS Code, and NullReceiver.
The Visanduma GitHub organization appears to have been compromised since mid-June 2026. Malicious changes were introduced through the compromised LaHiRu developer account, which also made hundreds of contributions to private repositories.
Socket Threat Research identified PolinRider in the dev-nova4support, dev-main, dev-using-inertia, and dev-nova5 branches of visanduma/nova-two-factor. No malicious stable release was identified; the campaign used compromised Git repositories, rewritten history, concealed JavaScript, dead-drop C2 resolution, and staged infostealer delivery.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 10 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A report from OpenSource Malware says the DPRK-linked **PolinRider** campaign compromised legitimate GitHub maintainer accounts and used them to publish malicious npm releases, highlighting a case involving developer **DiogoAngelim** and the packages `fetch-page-assets` and `html-to-gutenberg`. The report says `fetch-page-assets` version `1.2.9` was identified and removed under advisory `GHSA-vxq2-vhm7-7mhq`, but attackers continued publishing malicious versions `1.2.10` through `1.2.14`, with payloads tied to **PolinRider/NullReceiver** concealed in files including `.vscode/tasks.json`, a fake `.woff2` font, and later `babel.config.cjs`. The article says the compromise extended beyond a single package: all seven non-archived public repositories under the maintainer’s account were allegedly reinfected in coordinated force-push waves, indicating sustained attacker control over both the GitHub account and build environment. OpenSource Malware estimates the campaign has reached **4,367 repositories across 2,152 owners** and argues that current GitHub and npm response mechanisms, which focus on removing specific malicious versions, are insufficient when attackers retain control of trusted maintainer accounts and can repeatedly ship new poisoned releases.
Aug 25, 2026
Researchers reported a broad software supply chain campaign targeting developers and cryptocurrency users through hijacked packages, browser extensions, and compromised maintainer accounts across ecosystems including **npm**, **Go**, **Chrome**, and **Packagist**. Socket linked the activity to North Korean actors associated with the **Contagious Interview** operation and identified 108 malicious packages and extensions spanning 162 release artifacts, while JFrog separately analyzed hijacked npm packages `html-to-gutenberg` `4.2.11` and `fetch-page-assets` `1.2.9` that were uploaded with malicious code. The activity appears to rely on account hijacking rather than compromise of GitHub itself, and some attacker infrastructure reportedly remains active even after certain packages were removed. The malware chain used unusual delivery and evasion techniques aimed at developer workstations, including a **VS Code folder-open task** instead of standard npm lifecycle scripts, JavaScript hidden in a fake font file, and encrypted payload retrieval from blockchain transaction data on **TRON**, **Aptos**, and **BNB Smart Chain**. Researchers said the campaign deployed components including **BeaverTail**, **DEV#POPPER RAT**, **OmniStealer**, a `socket.io` backdoor, and a Python infostealer to steal browser credentials, password-manager contents, cryptocurrency wallet data, developer secrets, and operating system credential-store material across **Windows**, **macOS**, and **Linux**. Security firms warned that affected developer systems and credentials should be treated as fully compromised.
Aug 3, 2026
Two prerelease packages in the legitimate `@joyfill` npm namespace — `@joyfill/layouts@0.1.2-2773.beta.0` and `@joyfill/components@4.0.0-rc24-2773-beta.4` — were published with malicious code embedded in their distribution bundles, causing the payload to run when the package was imported rather than during installation. Researchers said the implant exposed Node.js `require` and `module` globally, resolved command-and-control infrastructure through transactions on **Tron**, **Aptos**, and **BNB Smart Chain**, and then fetched additional payloads including a Node.js remote-access trojan that opened a Socket.IO channel and a downloader contacting `23[.]27[.]13[.]43/$/boot` with the header `Sec-V: A9-0135-3`. Analysis linked the recovered malware to the **PolinRider** loader family and **DEV#POPPER**, while downstream activity also showed a Python credential stealer assessed as a likely **OmniStealer** variant targeting developer workstations. The compromise affects development environments, CI runners, test tooling, server-side rendering, and build systems that import the packages, and protections such as `npm install --ignore-scripts` do not prevent execution because the malicious logic was bundled before publication. Investigators said earlier versions, including `@joyfill/layouts@0.1.1` and `@joyfill/components@4.0.0-rc24`, appeared clean, and advised organizations to treat any environment using the `2773` prerelease versions as compromised, remove them, rebuild from trusted lockfiles, inspect for persistence, and rotate exposed credentials.
Jul 29, 2026