# PolinRider — DPRK Supply-Chain Campaign Compromises 1,951 GitHub Repos via Malicious npm Packages, VS Code tasks.json Auto-Run, and TRON/Aptos/BSC Blockchain Dead-Drop C2

> PolinRider is an active DPRK (Lazarus / Contagious Interview cluster) supply-chain campaign that has implanted obfuscated JavaScript payloads in 1,951 public GitHub repositories belonging to 1,047 unique owners as of 2026-04-11 — a 2.9x increase in five weeks. Initial access is achieved via Tailwind/PostCSS-themed malicious npm packages, weaponized .vscode/tasks.json files exploiting VS Code's runOn:folderOpen feature, fake .woff2 font files, and weaponized take-home interview templates (ShoeVista, StakingGame). The second-stage BeaverTail variant retrieves further payloads from immutable TRON, Aptos, and BSC blockchain transactions, making takedown infeasible.

- **Published:** 2026-04-29T12:00:00Z
- **Last reviewed:** 2026-04-29T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0437
- **ID:** TL-2026-0437
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** PolinRider (North Korea)
- **Detections:** 9 · **IOCs:** 48 (full data via the Threadlinqs MCP server — Purple tier)

## Description

PolinRider is an active large-scale software supply-chain attack attributed by OpenSourceMalware (OSM) and corroborated by The Hacker News, Wiz Threats DB, and SecurityOnline to North Korean state-sponsored actors operating under the Contagious Interview / WaterPlum / Nickel Alley cluster (operationally linked to Lazarus Group). OSM has now operationally merged PolinRider with the previously distinct TasksJacker cluster after observing 22 victim repositories simultaneously infected with both propagation scripts and weaponized .vscode/tasks.json payloads.

INITIAL ACCESS. The campaign uses four primary infection vectors. (1) Malicious npm packages typosquatted on Tailwind CSS and PostCSS naming conventions — including tailwindcss-style-animate (1.1.6, still active as of Apr 2026), tailwind-mainanimation, tailwind-autoanimation, tailwindcss-typography-style, tailwindcss-style-modify, tailwind-animationbased, and tailwindcss-animate-style — that fire postinstall hooks to inject obfuscated JavaScript into common config files. (2) Weaponized .vscode/tasks.json files using the runOn:folderOpen attribute to silently curl|bash a payload from Vercel C2 infrastructure the moment a developer opens the project in Visual Studio Code; Microsoft mitigated this in VS Code 1.109 (January 2026) by defaulting task.allowAutomaticTasks to off, but the attack remains effective on un-patched installations and against developers who manually re-enable the setting. (3) Fake .woff2 binary font files dropped under public/ or assets/ that contain encoded payloads (the 'fake-font' sub-variant). (4) Weaponized take-home coding interview templates — notably ShoeVista (a React/Node e-commerce template, 34+ victim reuploads) and StakingGame (template UUID e9b53a7c-2342-4b15-b02d-bd8b8f6a03f9, 42+ direct UUID matches) — distributed via fake LinkedIn recruiter outreach to crypto/Web3 founders, CTOs, and senior engineers (the classic Contagious Interview playbook).

PROPAGATION. Once a developer's machine is infected, the malware operates within the developer's existing GitHub authentication context — no credential theft is required. A propagation artifact named temp_auto_push.bat (observed in 101 victim repos with a 100% true-positive rate) is dropped to clone the victim's other repositories, append the obfuscated payload to common config files (postcss.config.mjs, tailwind.config.js/.mjs, eslint.config.mjs, next.config.mjs, vite.config.js/.mjs, webpack.config.js), and force-push the modifications. Critically, temp_auto_push.bat performs git history falsification: it extracts the original last-commit metadata, rolls system time back to that timestamp, runs git commit --amend --no-verify, restores system time, then force-pushes (git push -uf). The result is that malicious modifications appear unaltered in repository history — the implant is invisible to casual review of `git log`.

OBFUSCATION. Two active obfuscator variants are confirmed in the wild as of April 2026: the original v1 (signature 'rmcej%otb%', shuffle seeds 2857687/2667686, decoder _$_1e42, global marker global['!']) and the rotated v2 introduced 2026-04-10 (signature 'Cot%3t=shtP', shuffle seeds 1111436/3896884, decoder MDy, global marker global['_V']). The payload uses a 4-layer shuffle cipher and XOR decryption with two known keys (primary '2[gWfGj;<:-93Z^C', secondary 'm6:tTh^D)cBz?NM]') before eval()'ing the BeaverTail loader.

SECOND STAGE — BEAVERTAIL + BLOCKCHAIN DEAD-DROP. The second stage is a BeaverTail variant — a known Lazarus-family JavaScript stealer/downloader. Rather than hardcoding C2 endpoints, this variant fetches encrypted next-stage payloads from immutable blockchain transactions on TRON (addresses TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP and TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG), Aptos (tx hashes 0xbe037400670fbf1c32364f762975908dc43eeb38759263e7dfcdabc76380811e and 0x3f0e5781d0855fb460661ac63257376db1941b2bb522499e4757ecb3ebd5dce3), and BSC (via public RPC nodes bsc-dataseed.binance.org and bsc-rpc.publicnode.com). This blockchain dead-drop technique — also reported by Mandiant/Google as 'EtherHiding' for DPRK actors — is functionally takedown-proof since blockchain data is immutable and decentralized. Recovered payloads include InvisibleFerret (Python backdoor), OtterCookie, and the FlexibleFerret/WeaselStore family (Go and Python variants known as GolangGhost and PylangGhost), all consistent with the Contagious Interview tooling set. Capabilities include credential theft from Chromium-based browsers and Firefox, iCloud Keychain exfiltration on macOS, command execution, file enumeration, and arbitrary Node.js code execution.

C2 INFRASTRUCTURE. Vercel-hosted HTTPS C2 endpoints are used for the tasks.json delivery stage: 260120.vercel.app (56 victims, original), default-configuration.vercel.app (106 victims), vscode-settings-bootstrap.vercel.app (16 victims), vscode-settings-config.vercel.app (11 victims), vscode-bootstrapper.vercel.app (6 victims), and vscode-load-config.vercel.app (6 victims). Operators have begun migrating delivery to GitHub Gist scripts to evade Vercel takedowns.

SCALE AND TARGETING. As of 2026-04-11: 1,951 compromised public repositories spanning 1,047 unique owners, up from 675 repos / 352 owners on 2026-03-08. Primary targeting is at cryptocurrency, Web3, blockchain, and software development sectors globally, with concentration on entry-level and mid-career developers (ShoeVista lure) and senior crypto-industry leaders (recruiter-themed lures). Reports filed against malicious repositories totaled 821 submissions during the 2026-04-10/11 window alone.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1586 Compromise Accounts
- T1587 Develop Capabilities
- T1608 Stage Capabilities
- T1585 Establish Accounts
- T1195 Supply Chain Compromise
- T1566 Phishing
- T1199 Trusted Relationship
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1546 Event Triggered Execution
- T1027 Obfuscated Files or Information
- T1070 Indicator Removal
- T1036 Masquerading
- T1564 Hide Artifacts
- T1555 Credentials from Password Stores
- T1528 Steal Application Access Token
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1102 Web Service
- T1105 Ingress Tool Transfer
- T1573 Encrypted Channel
- T1041 Exfiltration Over C2 Channel
- T1565 Data Manipulation

## Sources

- [PolinRider: DPRK Threat Actor Implants Malware in Hundreds of GitHub Repos (OpenSourceMalware)](https://opensourcemalware.com/blog/polinrider-attack)
- [PolinRider Technical Dossier (OpenSourceMalware GitHub)](https://github.com/OpenSourceMalware/PolinRider)
- [North Korean Hackers Abuse VS Code Auto-Run Tasks to Deploy StoatWaffle Malware](https://thehackernews.com/2026/03/north-korean-hackers-abuse-vs-code-auto.html)
- [PolinRider supply chain attack (Wiz Threats DB)](https://threats.wiz.io/all-incidents/polinrider-supply-chain-attack)
- [The Invisible Patch: How PolinRider Rewrites Git History to Hide North Korean Malware](https://securityonline.info/polinrider-dprk-malware-github-history-falsification/)
- [DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains](https://cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding)
- [Contagious Interview (DPRK) Launches a New Campaign Creating Three Front Companies (Silent Push)](https://www.silentpush.com/blog/contagious-interview-front-companies/)
- [Apache Superset GitHub Issue #39299 — PolinRider Targeting Notice](https://github.com/apache/superset/issues/39299)
- [North Korean Hackers Turn VS Code Projects Into Silent Malware Triggers (IT Security News)](https://www.itsecuritynews.info/north-korean-hackers-turn-vs-code-projects-into-silent-malware-triggers/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0437