Loading story…
PolinRider operators compromised developer endpoints and used legitimate contributor credentials to repeatedly force-push malicious commits into three Binary-Mindz GitHub repositories. The supply-chain campaign embedded obfuscated JavaScript in fake Font Awesome .woff2 files and triggered execution through VS Code folder-open tasks and altered executable configuration files, including eslint.config.mjs and prisma.config.ts. Cleanup limited to repositories failed at least three times because other infected contributors reintroduced the code in rewritten commits retaining trusted authors, messages, and timestamps.
The operators deployed and evolved multiple payload variants—fa-solid-400.woff2, fa-solid-500.woff2, and fa-solid-900.woff2—apparently testing detection evasion. The 500 variant used an Ethereum NullReceiver dead-drop wallet to resolve command-and-control infrastructure, while the more obfuscated 900 variant adopted a legitimate Font Awesome filename and project-specific nested paths. A social-media post claimed the activity traced to North Korea, but provided no supporting technical evidence or independent attribution details.
Trace attribution and downstream blast radius.
7 events from the most recent confirmed update back to the earliest known activity.
The fa-solid-900.woff2 payload was force-pushed to every branch of all three Binary-Mindz repositories between 01:30 and 01:38 UTC. It used a legitimate Font Awesome filename and project-specific nested paths to appear benign and evade detection.
The fa-solid-500.woff2 payload appeared in diegovillariber-backend and later the same day in rk-dodani-backend. This variant used an Ethereum NullReceiver wallet dead drop to resolve its C2 infrastructure.
Developers again attempted to remove the malware, but infected contributor activity subsequently reintroduced malicious content through force-pushed rewritten commits.
Binary-Mindz developers attempted to remove the malware on May 21 and May 22, but force-pushes from other contributor accounts restored the payloads or malicious VS Code task.
The fa-solid-400.woff2 malicious payload appeared in diegovillariber-backend and rk-dodani-backend 13 seconds apart.
The alamin-sujon account force-pushed a malicious VS Code folder-open curl task to agimtula_server, then to diegovillariber-backend three minutes later. The task fetched and executed scripts from 260120.vercel[.]app when a repository was opened in VS Code.
The Binary-Mindz GitHub organization was created, later hosting the affected public TypeScript backend repositories agimtula_server, diegovillariber-backend, and rk-dodani-backend.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A report from OpenSource Malware says the DPRK-linked **PolinRider** campaign compromised legitimate GitHub maintainer accounts and used them to publish malicious npm releases, highlighting a case involving developer **DiogoAngelim** and the packages `fetch-page-assets` and `html-to-gutenberg`. The report says `fetch-page-assets` version `1.2.9` was identified and removed under advisory `GHSA-vxq2-vhm7-7mhq`, but attackers continued publishing malicious versions `1.2.10` through `1.2.14`, with payloads tied to **PolinRider/NullReceiver** concealed in files including `.vscode/tasks.json`, a fake `.woff2` font, and later `babel.config.cjs`. The article says the compromise extended beyond a single package: all seven non-archived public repositories under the maintainer’s account were allegedly reinfected in coordinated force-push waves, indicating sustained attacker control over both the GitHub account and build environment. OpenSource Malware estimates the campaign has reached **4,367 repositories across 2,152 owners** and argues that current GitHub and npm response mechanisms, which focus on removing specific malicious versions, are insufficient when attackers retain control of trusted maintainer accounts and can repeatedly ship new poisoned releases.
Aug 25, 2026
PolinRider operators compromised the Visanduma GitHub organization and implanted malware in four development branches of the Packagist package `visanduma/nova-two-factor`, which has more than 700,000 cumulative downloads. The malicious code was present in `dev-*` branches, including `dev-main`; Socket reported no compromised stable release, limiting known exposure primarily to users resolving development branches. The campaign spreads through compromised developer accounts and repositories, with malicious files capable of executing when a developer opens an affected repository in a compatible IDE or runs standard build and test workflows. It uses rewritten Git history, concealed JavaScript, EtherHiding or NullReceiver dead-drop C2 resolution, and staged infostealer delivery; a newer variant invokes obfuscated JavaScript from PHP through `shell_exec`. Organizations that executed affected repositories should investigate potential endpoint compromise, reimage systems where warranted, rotate credentials, and review Git history, account activity, and automated IDE and build execution paths.
Sep 23, 2026
Researchers reported a broad software supply chain campaign targeting developers and cryptocurrency users through hijacked packages, browser extensions, and compromised maintainer accounts across ecosystems including **npm**, **Go**, **Chrome**, and **Packagist**. Socket linked the activity to North Korean actors associated with the **Contagious Interview** operation and identified 108 malicious packages and extensions spanning 162 release artifacts, while JFrog separately analyzed hijacked npm packages `html-to-gutenberg` `4.2.11` and `fetch-page-assets` `1.2.9` that were uploaded with malicious code. The activity appears to rely on account hijacking rather than compromise of GitHub itself, and some attacker infrastructure reportedly remains active even after certain packages were removed. The malware chain used unusual delivery and evasion techniques aimed at developer workstations, including a **VS Code folder-open task** instead of standard npm lifecycle scripts, JavaScript hidden in a fake font file, and encrypted payload retrieval from blockchain transaction data on **TRON**, **Aptos**, and **BNB Smart Chain**. Researchers said the campaign deployed components including **BeaverTail**, **DEV#POPPER RAT**, **OmniStealer**, a `socket.io` backdoor, and a Python infostealer to steal browser credentials, password-manager contents, cryptocurrency wallet data, developer secrets, and operating system credential-store material across **Windows**, **macOS**, and **Linux**. Security firms warned that affected developer systems and credentials should be treated as fully compromised.
Aug 3, 2026