PolinRider — DPRK Supply-Chain Campaign Compromises 1,951 GitHub Repos via Malicious npm Packages, VS Code tasks.json Auto-Run, and TRON/Aptos/BSC Blockchain Dead-Drop C2 — Threadlinqs Intelligence
As of 2026-05-30, PolinRider — DPRK Supply-Chain Campaign Compromises 1,951 GitHub Repos via Malicious npm Packages, VS Code tasks.json Auto-Run, and TRON/Aptos/BSC Blockchain Dead-Drop C2 is a critical-severity supply chain threat attributed to PolinRider (North Korea (DPRK)), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 48 indicators of compromise.
Threat ID: TL-2026-0437 · Severity: CRITICAL · Status: ACTIVE · Category: SUPPLY_CHAIN
Attribution: PolinRider · North Korea (DPRK) · FINANCIAL
PolinRider is an active DPRK (Lazarus / Contagious Interview cluster) supply-chain campaign that has implanted obfuscated JavaScript payloads in 1,951 public GitHub repositories belonging to 1,047
PolinRider is an active large-scale software supply-chain attack attributed by OpenSourceMalware (OSM) and corroborated by The Hacker News, Wiz Threats DB, and SecurityOnline to North Korean state-sponsored actors operating under the Contagious Interview / WaterPlum / Nickel Alley cluster (operationally linked to Lazarus Group). OSM has now operationally merged PolinRider with the previously distinct TasksJacker cluster after observing 22 victim repositories simultaneously infected with both propagation scripts and weaponized .vscode/tasks.json payloads.
INITIAL ACCESS. The campaign uses four primary infection vectors. (1) Malicious npm packages typosquatted on Tailwind CSS and PostCSS naming conventions — including tailwindcss-style-animate (1.1.6, still active as of Apr 2026), tailwind-mainanimation, tailwind-autoanimation, tailwindcss-typography-style, tailwindcss-style-modify, tailwind-animationbased, and tailwindcss-animate-style — that fire postinstall hooks to inject obfuscated JavaScript into common config files. (2) Weaponized .vscode/tasks.json files using the runOn:folderOpen attribute to silently curl|bash a payload from Vercel C2 infrastructure the moment a developer opens the project in Visual Studio Code; Microsoft mitigated this in VS Code 1.109 (January 2026) by defaulting task.allowAutomaticTasks to off, but the attack remains effective on un-patched installations and against developers who manually re-enable the setting. (3) Fake .woff2 binary font files dropped under public/ or assets/ that contain encoded payloads (the 'fake-font' sub-variant). (4) Weaponized take-home coding interview templates — notably ShoeVista (a React/Node e-commerce template, 34+ victim reuploads) and StakingGame (template UUID e9b53a7c-2342-4b15-b02d-bd8b8f6a03f9, 42+ direct UUID matches) — distributed via fake LinkedIn recruiter outreach to crypto/Web3 founders, CTOs, and senior engineers (the classic Contagious Interview playbook).
PROPAGATION. Once a developer's machine is infected, the malware operates within the developer's existing GitHub authentication context — no credential theft is required. A propagation artifact named temp_auto_push.bat (observed in 101 victim repos with a 100% true-positive rate) is dropped to clone the victim's other repositories, append the obfuscated payload to common config files (postcss.config.mjs, tailwind.config.js/.mjs, eslint.config.mjs, next.config.mjs, vite.config.js/.mjs, webpack.config.js), and force-push the modifications. Critically, temp_auto_push.bat performs git history falsification: it extracts the original last-commit metadata, rolls system time back to that timestamp, runs git commit --amend --no-verify, restores system time, then force-pushes (git push -uf). The result is that malicious modifications appear unaltered in repository history — the implant is invisible to casual review of `git log`.
OBFUSCATION. Two active obfuscator variants are confirmed in the wild as of April 2026: the original v1 (signature 'rmcej%otb%', shuffle seeds 2857687/2667686, decoder _$_1e42, global marker global['!']) and the rotated v2 introduced 2026-04-10 (signature 'Cot%3t=shtP', shuffle seeds 1111436/3896884, decoder MDy, global marker global['_V']). The payload uses a 4-layer shuffle cipher and XOR decryption with two known keys (primary '2[gWfGj;<:-93Z^C', secondary 'm6:tTh^D)cBz?NM]') before eval()'ing the BeaverTail loader.
SECOND STAGE — BEAVERTAIL + BLOCKCHAIN DEAD-DROP. The second stage is a BeaverTail variant — a known Lazarus-family JavaScript stealer/downloader. Rather than hardcoding C2 endpoints, this variant fetches encrypted next-stage payloads from immutable blockchain transactions on TRON (addresses TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP and TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG), Aptos (tx hashes 0xbe037400670fbf1c32364f762975908dc43eeb38759263e7dfcdabc76380811e and 0x3f0e5781d0855fb460661ac63257376db1941b2bb522499e4757ecb3ebd5dce3), and BSC (via public RPC nodes bsc-dataseed.binanc
Weaknesses (CWE)
CWE-506, CWE-829, CWE-494, CWE-78, CWE-114
Target sectors: technology, software-development, cryptocurrency, blockchain, web3, fintech, open-source-software
Target regions: Global, North America, Europe, Asia-Pacific
Detections & IOCs
As of 2026-08-17, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 48 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1583, T1586, T1587, T1608, T1585, T1195, T1566, T1199, T1204, T1059
