astro.config.mjs Supply Chain Attack via Blockchain Dead-Drop C2 (PolinRider / js.jadesnow) — Threadlinqs Intelligence
As of 2026-06-18, astro.config.mjs Supply Chain Attack via Blockchain Dead-Drop C2 (PolinRider / js.jadesnow) is a high-severity supply chain threat attributed to PolinRider (North Korea), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 27 indicators of compromise.
Threat ID: TL-2026-0846 · Severity: HIGH · Status: ACTIVE · Category: SUPPLY_CHAIN
Attribution: PolinRider · North Korea · FINANCIAL
DPRK-linked actor PolinRider attempted to poison the Egonex-AI/Understand-Anything repository (57,000+ GitHub stars) by submitting three malicious pull requests (#198, #206, #261) that injected
In late May 2026 a GitHub account named AsimRaza10 opened three pull requests (#198, #206, #261) against Egonex-AI/Understand-Anything, a popular (57,000+ star) code-to-knowledge-graph tool. All three PRs carried cover stories that did not match their diffs (a README edit, a React 'Path Finder' reachability fix referencing useEffect/useMemo files that were never touched, and a community-health chore) yet every one modified only .gitignore and homepage/astro.config.mjs and resolved to the same commit 8d30be36. The malicious code was hidden behind hundreds of characters of horizontal whitespace on a single line so it rendered past GitHub's visible diff area, and the .gitignore additions concealed Windows propagation helpers (branch_structure.json, temp_auto_push.bat, temp_interactive_push.bat).
Because Astro evaluates astro.config.mjs as a Node.js module before any user code on every `astro build`, `astro dev`, and `astro preview`, the payload executes with full filesystem and environment access in developer and CI/CD contexts. The injected, heavily obfuscated IIFE (string-shuffle cipher via the _$_1e42 decoder, shuffle marker rmcej%otb%, layer-1 seed 2857687) reconstructs require() in the ESM context using createRequire(import.meta.url) and runs a two-stage loader.
Stage B ('boot') selects a hard-coded HTTP C2 based on a campaign marker stored in global._V, beacons the /$/boot endpoint with a spoofed Chrome 131 User-Agent, XOR-decrypts the response with key 'ThZG+0jfXE6VAGOJ', and eval()s the downloaded bot, exfiltrating the campaign marker in a 'Sec-V' header. Stage A ('resolver') implements a blockchain dead-drop: it reads the latest outgoing transaction from a Tron address, extracts and reverses the raw_data.data hex to obtain a BSC transaction hash (falling back to an Aptos account payload), fetches that BSC transaction via eth_getTransactionByHash, hex-decodes tx.input, splits on the delimiter '?.?', and XOR-decrypts the right segment with key '2[gWfGj;<:-93Z^C' before eval()ing the resulting JavaScript command. Because only public RPC nodes are contacted and commands live in immutable blockchain transactions, the operator can rotate the next-stage payload without touching the repository and the channel resists DNS/IP blocklisting.
SafeDep attributes the operation to the DPRK-linked PolinRider campaign (Malpedia family js.jadesnow), citing matching cryptographic fingerprints: the _$_1e42 decoder, the un-rotated rmcej%otb% shuffle marker, layer-1 seed 2857687, the identical Tron dead-drop address, the identical chain XOR key, and the temp_auto_push.bat propagation artifact. The js.jadesnow/JADESNOW lineage overlaps with GTIG's UNC5342 'Contagious Interview' EtherHiding activity that uses JADESNOW to stage a JavaScript InvisibleFerret variant for cryptocurrency theft. This is the first documented instance of PolinRider targeting an upstream repository's PR workflow rather than directly infecting individual developers; the variant uses the original (v1) obfuscation predating the April 2026 rotation, suggesting lagging tooling or a parallel operator. All three PRs were identified during static review and disclosed publicly via GitHub issue #432 on 2026-06-12.
Weaknesses (CWE)
CWE-506, CWE-829, CWE-1357, CWE-94
Target sectors: technology, software development, open source, cryptocurrency, developer tooling
Target regions: Global, North America, Europe, Asia
Detections & IOCs
As of 2026-07-27, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 27 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1585, T1587, T1608, T1195, T1199, T1059, T1505, T1027, T1140, T1036