Threat reportSupply ChainTL-2026-0437
PolinRider — DPRK Supply-Chain Campaign Compromises 1,951 GitHub Repos via Malicious npm Packages, VS Code tasks.json Auto-Run, and TRON/Aptos/BSC Blockchain Dead-Drop C2
PolinRider — DPRK Supply-Chain Campaign Compromises 1,951 (TL-2026-0437), also tracked as PolinRider, is a critical-severity supply-chain compromise, first published 2026-04-29. It is attributed to PolinRider (North Korea) with high confidence, affects Microsoft Visual Studio Code, maps to 27 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 48 indicators of compromise.
- Severity
- CRITICALAssessed severity
- CVEs
- 0None referenced
- Techniques
- 27MITRE ATT&CK
- Actors
- 1PolinRider
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 48Indicators of compromise
Key facts for TL-2026-0437
- Threat ID
- TL-2026-0437
- Also known as
- PolinRider, TasksJacker (operationally merged), Contagious Interview - GitHub Repo Variant, DeceptiveDevelopment - PolinRider
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution
- PolinRider
- Attribution confidence
- HIGH
- Nation-state nexus
- North Korea
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, cryptocurrency, blockchain, web3, fintech, open-source-software
- Target regions
- Global, North America, Europe, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 48
Malware and tooling in PolinRider — DPRK Supply-Chain Campaign Compromises 1,951
Malware and tooling: BeaverTail - S1246, FlexibleFerret/WeaselStore (GolangGhost / PylangGhost), InvisibleFerret - S1245, OtterCookie, StoatWaffle, BeaverTail-PolinRider-blockchain-dead-drop, ShoeVista take-home template, StakingGame take-home template (UUID e9b53a7c-2342-4b15-b02d-bd8b8f6a03f9)
How PolinRider — DPRK Supply-Chain Campaign Compromises 1,951 works
PolinRider is an active DPRK (Lazarus / Contagious Interview cluster) supply-chain campaign that has implanted obfuscated JavaScript payloads in 1,951 public GitHub repositories belonging to 1,047 unique owners as of 2026-04-11 — a 2.9x increase in five weeks. Initial access is achieved via Tailwind/PostCSS-themed malicious npm packages, weaponized .vscode/tasks.json files exploiting VS Code's runOn:folderOpen feature, fake .woff2 font files, and weaponized take-home interview templates (ShoeVista, StakingGame). The second-stage BeaverTail variant retrieves further payloads from immutable TRON, Aptos, and BSC blockchain transactions, making takedown infeasible.
PolinRider is an active large-scale software supply-chain attack attributed by OpenSourceMalware (OSM) and corroborated by The Hacker News, Wiz Threats DB, and SecurityOnline to North Korean state-sponsored actors operating under the Contagious Interview / WaterPlum / Nickel Alley cluster (operationally linked to Lazarus Group). OSM has now operationally merged PolinRider with the previously distinct TasksJacker cluster after observing 22 victim repositories simultaneously infected with both propagation scripts and weaponized .vscode/tasks.json payloads.
INITIAL ACCESS. The campaign uses four primary infection vectors. (1) Malicious npm packages typosquatted on Tailwind CSS and PostCSS naming conventions — including tailwindcss-style-animate (1.1.6, still active as of Apr 2026), tailwind-mainanimation, tailwind-autoanimation, tailwindcss-typography-style, tailwindcss-style-modify, tailwind-animationbased, and tailwindcss-animate-style — that fire postinstall hooks to inject obfuscated JavaScript into common config files. (2) Weaponized .vscode/tasks.json files using the runOn:folderOpen attribute to silently curl|bash a payload from Vercel C2 infrastructure the moment a developer opens the project in Visual Studio Code; Microsoft mitigated this in VS Code 1.109 (January 2026) by defaulting task.allowAutomaticTasks to off, but the attack remains effective on un-patched installations and against developers who manually re-enable the setting. (3) Fake .woff2 binary font files dropped under public/ or assets/ that contain encoded payloads (the 'fake-font' sub-variant). (4) Weaponized take-home coding interview templates — notably ShoeVista (a React/Node e-commerce template, 34+ victim reuploads) and StakingGame (template UUID e9b53a7c-2342-4b15-b02d-bd8b8f6a03f9, 42+ direct UUID matches) — distributed via fake LinkedIn recruiter outreach to crypto/Web3 founders, CTOs, and senior engineers (the classic Contagious Interview playbook).
PROPAGATION. Once a developer's machine is infected, the malware operates within the developer's existing GitHub authentication context — no credential theft is required. A propagation artifact named temp_auto_push.bat (observed in 101 victim repos with a 100% true-positive rate) is dropped to clone the victim's other repositories, append the obfuscated payload to common config files (postcss.config.mjs, tailwind.config.js/.mjs, eslint.config.mjs, next.config.mjs, vite.config.js/.mjs, webpack.config.js), and force-push the modifications. Critically, temp_auto_push.bat performs git history falsification: it extracts the original last-commit metadata, rolls system time back to that timestamp, runs git commit --amend --no-verify, restores system time, then force-pushes (git push -uf). The result is that malicious modifications appear unaltered in repository history — the implant is invisible to casual review of `git log`.
OBFUSCATION. Two active obfuscator variants are confirmed in the wild as of April 2026: the original v1 (signature 'rmcej%otb%', shuffle seeds 2857687/2667686, decoder _$_1e42, global marker global['!']) and the rotated v2 introduced 2026-04-10 (signature 'Cot%3t=shtP', shuffle seeds 1111436/3896884, decoder MDy, global marker global['_V']). The payload uses a 4-layer shuffle cipher and XOR decryption with two known keys (primary '2[gWfGj;<:-93Z^C', secondary 'm6:tTh^D)cBz?NM]') before eval()'ing the BeaverTail loader.
SECOND STAGE — BEAVERTAIL + BLOCKCHAIN DEAD-DROP. The second stage is a BeaverTail variant — a known Lazarus-family JavaScript stealer/downloader. Rather than hardcoding C2 endpoints, this variant fetches encrypted next-stage payloads from immutable blockchain transactions on TRON (addresses TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP and TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG), Aptos (tx hashes 0xbe037400670fbf1c32364f762975908dc43eeb38759263e7dfcdabc76380811e and 0x3f0e5781d0855fb460661ac63257376db1941b2bb522499e4757ecb3ebd5dce3), and BSC (via public RPC nodes bsc-dataseed.binance.org and bsc-rpc.publicnode.com). This blockchain dead-drop technique — also reported by Mandiant/Google as 'EtherHiding' for DPRK actors — is functionally takedown-proof since blockchain data is immutable and decentralized. Recovered payloads include InvisibleFerret (Python backdoor), OtterCookie, and the FlexibleFerret/WeaselStore family (Go and Python variants known as GolangGhost and PylangGhost), all consistent with the Contagious Interview tooling set. Capabilities include credential theft from Chromium-based browsers and Firefox, iCloud Keychain exfiltration on macOS, command execution, file enumeration, and arbitrary Node.js code execution.
C2 INFRASTRUCTURE. Vercel-hosted HTTPS C2 endpoints are used for the tasks.json delivery stage: 260120.vercel.app (56 victims, original), default-configuration.vercel.app (106 victims), vscode-settings-bootstrap.vercel.app (16 victims), vscode-settings-config.vercel.app (11 victims), vscode-bootstrapper.vercel.app (6 victims), and vscode-load-config.vercel.app (6 victims). Operators have begun migrating delivery to GitHub Gist scripts to evade Vercel takedowns.
SCALE AND TARGETING. As of 2026-04-11: 1,951 compromised public repositories spanning 1,047 unique owners, up from 675 repos / 352 owners on 2026-03-08. Primary targeting is at cryptocurrency, Web3, blockchain, and software development sectors globally, with concentration on entry-level and mid-career developers (ShoeVista lure) and senior crypto-industry leaders (recruiter-themed lures). Reports filed against malicious repositories totaled 821 submissions during the 2026-04-10/11 window alone.
MITRE ATT&CK techniques used in TL-2026-0437
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1564 Hide Artifacts
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer; T1573 Encrypted Channel
Discovery
T1082 System Information Discovery; T1083 File and Directory Discovery
Initial Access
T1195 Supply Chain Compromise; T1199 Trusted Relationship; T1566 Phishing
Credential Access
T1528 Steal Application Access Token; T1555 Credentials from Password Stores
Persistence
T1546 Event Triggered Execution; T1547 Boot or Logon Autostart Execution
Impact
Resource Development
T1583 Acquire Infrastructure; T1585 Establish Accounts; T1586 Compromise Accounts; T1587 Develop Capabilities; T1608 Stage Capabilities
Affected products and versions in PolinRider — DPRK Supply-Chain Campaign Compromises 1,951
- Microsoft — Visual Studio Code
Vulnerable versions: < 1.109
Fixed in: >= 1.109 - npm Inc. (registry) — tailwindcss-style-animate
Vulnerable versions: 1.1.6 - npm Inc. (registry) — tailwind-mainanimation
Vulnerable versions: 2.3.3 - npm Inc. (registry) — tailwind-autoanimation
Vulnerable versions: 2.3.6 - npm Inc. (registry) — tailwindcss-typography-style
Vulnerable versions: 0.8.2 - npm Inc. (registry) — tailwindcss-style-modify
Vulnerable versions: 0.8.3 - npm Inc. (registry) — tailwind-animationbased
Vulnerable versions: all - npm Inc. (registry) — tailwindcss-animate-style
Vulnerable versions: all - GitHub (Microsoft) — GitHub.com — public repositories
Vulnerable versions: 1,951 confirmed compromised public repos / 1,047 owners as of 2026-04-11
Remediation for PolinRider — DPRK Supply-Chain Campaign Compromises 1,951
Patches
- Microsoft VS Code >= 1.109 (Jan 2026) — defaults task.allowAutomaticTasks to off.
Immediate actions
- Audit ALL config files (postcss.config.mjs, tailwind.config.js/.mjs, eslint.config.mjs, next.config.mjs, vite.config.*, webpack.config.js) for appended obfuscated JavaScript blocks containing markers 'rmcej%otb%' or 'Cot%3t=shtP'.
- Search every developer workstation and CI runner for temp_auto_push.bat — 100% true-positive indicator. Quarantine on detection.
- Block the seven Vercel C2 subdomains (*.vercel.app PolinRider list) at egress proxies and DNS resolvers.
- Block the two TRON addresses and two Aptos transaction hashes at any blockchain-aware monitoring tooling; alert on outbound connections to bsc-dataseed.binance.org and bsc-rpc.publicnode.com from non-DeFi developer machines.
- Remove the seven malicious npm packages from internal registries, package-lock files, and yarn.lock files; force re-install from clean state.
- Disable VS Code task.allowAutomaticTasks or upgrade to VS Code 1.109+ (Microsoft fix released January 2026).
- Force credential rotation for all developers (GitHub PATs, npm tokens, SSH keys, browser-stored credentials, macOS Keychain, AWS/GCP/Azure CLI tokens).
Workarounds
- Set 'task.allowAutomaticTasks': 'off' in VS Code settings.json regardless of version.
- Always inspect .vscode/tasks.json before opening any cloned repository.
- Use GitHub's --no-tags shallow clone and read-only review tools (gh, gitk) before opening untrusted repos in an IDE.
Longer-term hardening
- Deploy EDR with behavioral detection for child processes spawned by Code.exe / electron processes (curl, bash, powershell, node).
- Enforce npm package signing / provenance attestations and pin to known-good versions.
- Monitor GitHub repository force-push events on public org repos; alert on commits whose author timestamp matches a prior commit (history-rewrite indicator).
- Run static analysis on every commit looking for high-entropy strings appended after legitimate exports in config files.
- Block postinstall scripts by default in CI (npm install --ignore-scripts, yarn install --ignore-scripts).
- Educate developers on Contagious Interview lures: refuse to clone/run unsolicited take-home coding tests in primary dev environments — use a disposable VM.
Weaknesses (CWE) in PolinRider — DPRK Supply-Chain Campaign Compromises 1,951
Timeline of PolinRider — DPRK Supply-Chain Campaign Compromises 1,951
- Silent Push publishes research on Contagious Interview front-company operation distributing BeaverTail / InvisibleFerret / OtterCookie — establishing the tooling baseline that PolinRider builds on.
- OpenSourceMalware (OSM) publishes initial PolinRider disclosure: hundreds of public GitHub repositories implanted with obfuscated JavaScript via malicious Tailwind/PostCSS-themed npm packages.
- OSM baseline scope: 675 compromised public repositories belonging to 352 unique GitHub owners.
- Google Cloud / Mandiant publishes 'DPRK Adopts EtherHiding' research, formally attributing blockchain-dead-drop C2 (TRON / BSC / Aptos) to North Korean state actors — corroborating PolinRider's second-stage architecture.
- The Hacker News reports DPRK abuse of VS Code .vscode/tasks.json runOn:folderOpen feature to deploy StoatWaffle malware; Microsoft confirms VS Code 1.109 (Jan 2026) defaulted task.allowAutomaticTasks to off as mitigation.
- Wiz Threats Database publishes PolinRider supply-chain incident page; classifies as DPRK-linked supply-chain compromise via trojanized VS Code extension and developer environment hijack.
- Apache Superset GitHub issue #39299 filed — public-project targeting notice that malicious forks attributed to PolinRider were identified against the upstream Apache Superset repository.
- Five new Vercel-hosted C2 subdomains observed (default-configuration / vscode-settings-bootstrap / vscode-settings-config / vscode-bootstrapper / vscode-load-config); 821 abuse reports filed against malicious repos in the 2026-04-10/11 window.
- Second active obfuscator variant (signature 'Cot%3t=shtP', shuffle seeds 1111436/3896884, decoder MDy) confirmed in the wild alongside the original v1 'rmcej%otb%' variant.
- SecurityOnline publishes 'The Invisible Patch' research detailing temp_auto_push.bat git-history falsification (timestamp rollback + --amend --no-verify + force-push) as the propagation mechanism that hides modifications in `git log`.
- OSM updates scope: 1,951 compromised public repositories across 1,047 unique owners — 2.9x growth in five weeks. Operational merger of TasksJacker and PolinRider clusters confirmed (22 dual-infected repos).
- Threadlinqs Intelligence publishes TL-2026-0437 — full MITRE / IOC / detection / simulation coverage for the active campaign.
- As of 2026-05-29, PolinRider remains an active DPRK supply-chain campaign: Sonatype (May 21, 2026) confirmed a fresh hijacked npm package using its signature TRON blockchain dead-drop, and OSM reports continued GitHub expansion. Partial mitigations (VS Code 1.109, deleted npm accounts) exist, but no actor disruption, takedown-proof blockchain C2, and infected repos persist.
Sources cited for PolinRider — DPRK Supply-Chain Campaign Compromises 1,951
- PolinRider: DPRK Threat Actor Implants Malware in Hundreds of GitHub Repos (OpenSourceMalware)
- PolinRider Technical Dossier (OpenSourceMalware GitHub)
- North Korean Hackers Abuse VS Code Auto-Run Tasks to Deploy StoatWaffle Malware
- PolinRider supply chain attack (Wiz Threats DB)
- The Invisible Patch: How PolinRider Rewrites Git History to Hide North Korean Malware
- DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains
- Contagious Interview (DPRK) Launches a New Campaign Creating Three Front Companies (Silent Push)
- Apache Superset GitHub Issue #39299 — PolinRider Targeting Notice
- North Korean Hackers Turn VS Code Projects Into Silent Malware Triggers (IT Security News)
Detection coverage for TL-2026-0437
As of 2026-04-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0437 across Splunk SPL, Microsoft KQL and Sigma, covering 48 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.