# astro.config.mjs Supply Chain Attack via Blockchain Dead-Drop C2 (PolinRider / js.jadesnow)

> DPRK-linked actor PolinRider attempted to poison the Egonex-AI/Understand-Anything repository (57,000+ GitHub stars) by submitting three malicious pull requests (#198, #206, #261) that injected obfuscated JavaScript into homepage/astro.config.mjs. Astro automatically evaluates this config on every build/dev/preview, executing a two-stage loader that resolves commands from a Tron/BSC/Aptos blockchain dead drop, making the C2 resilient to IP and DNS takedown.

- **Published:** 2026-06-18T00:00:00Z
- **Last reviewed:** 2026-08-04T20:00:04Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0846
- **ID:** TL-2026-0846
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** PolinRider (North Korea)
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In late May 2026 a GitHub account named AsimRaza10 opened three pull requests (#198, #206, #261) against Egonex-AI/Understand-Anything, a popular (57,000+ star) code-to-knowledge-graph tool. All three PRs carried cover stories that did not match their diffs (a README edit, a React 'Path Finder' reachability fix referencing useEffect/useMemo files that were never touched, and a community-health chore) yet every one modified only .gitignore and homepage/astro.config.mjs and resolved to the same commit 8d30be36. The malicious code was hidden behind hundreds of characters of horizontal whitespace on a single line so it rendered past GitHub's visible diff area, and the .gitignore additions concealed Windows propagation helpers (branch_structure.json, temp_auto_push.bat, temp_interactive_push.bat).

Because Astro evaluates astro.config.mjs as a Node.js module before any user code on every `astro build`, `astro dev`, and `astro preview`, the payload executes with full filesystem and environment access in developer and CI/CD contexts. The injected, heavily obfuscated IIFE (string-shuffle cipher via the _$_1e42 decoder, shuffle marker rmcej%otb%, layer-1 seed 2857687) reconstructs require() in the ESM context using createRequire(import.meta.url) and runs a two-stage loader.

Stage B ('boot') selects a hard-coded HTTP C2 based on a campaign marker stored in global._V, beacons the /$/boot endpoint with a spoofed Chrome 131 User-Agent, XOR-decrypts the response with key 'ThZG+0jfXE6VAGOJ', and eval()s the downloaded bot, exfiltrating the campaign marker in a 'Sec-V' header. Stage A ('resolver') implements a blockchain dead-drop: it reads the latest outgoing transaction from a Tron address, extracts and reverses the raw_data.data hex to obtain a BSC transaction hash (falling back to an Aptos account payload), fetches that BSC transaction via eth_getTransactionByHash, hex-decodes tx.input, splits on the delimiter '?.?', and XOR-decrypts the right segment with key '2[gWfGj;<:-93Z^C' before eval()ing the resulting JavaScript command. Because only public RPC nodes are contacted and commands live in immutable blockchain transactions, the operator can rotate the next-stage payload without touching the repository and the channel resists DNS/IP blocklisting.

SafeDep attributes the operation to the DPRK-linked PolinRider campaign (Malpedia family js.jadesnow), citing matching cryptographic fingerprints: the _$_1e42 decoder, the un-rotated rmcej%otb% shuffle marker, layer-1 seed 2857687, the identical Tron dead-drop address, the identical chain XOR key, and the temp_auto_push.bat propagation artifact. The js.jadesnow/JADESNOW lineage overlaps with GTIG's UNC5342 'Contagious Interview' EtherHiding activity that uses JADESNOW to stage a JavaScript InvisibleFerret variant for cryptocurrency theft. This is the first documented instance of PolinRider targeting an upstream repository's PR workflow rather than directly infecting individual developers; the variant uses the original (v1) obfuscation predating the April 2026 rotation, suggesting lagging tooling or a parallel operator. All three PRs were identified during static review and disclosed publicly via GitHub issue #432 on 2026-06-12.

## MITRE ATT&CK

- T1585 Establish Accounts
- T1587 Develop Capabilities
- T1608 Stage Capabilities
- T1195 Supply Chain Compromise
- T1199 Trusted Relationship
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1071 Application Layer Protocol
- T1102 Web Service
- T1008 Fallback Channels
- T1573 Encrypted Channel
- T1132 Data Encoding
- T1105 Ingress Tool Transfer
- T1555 Credentials from Password Stores
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft

## Sources

- [astro.config.mjs Supply Chain Attack via Blockchain C2](https://safedep.io/astro-config-blockchain-c2-supply-chain/)
- [Malpedia library entry: js.jadesnow (astro.config.mjs Supply Chain Attack via Blockchain C2)](https://malpedia.caad.fkie.fraunhofer.de/library/907ea97d-6a68-4520-8ccf-bf5e91c007a6/)
- [PolinRider Campaign: DPRK-Linked Supply Chain Attack Infects GitHub Repositories](https://imtr.net/article/polinrider-campaign-dprk-linked-supply-chain-attack-infects-github-repositories-9d29)
- [PolinRider Rides Again: North Korean Attack Expands Across GitHub](https://opensourcemalware.com/blog/polinrider-rides-again)
- [PolinRider: DPRK Threat Actor That Compromised Hundreds of GitHub Repos Is Unmasked](https://opensourcemalware.com/blog/polinrider-attack)
- [PolinRider Campaign (Wiz Threats)](https://threats.wiz.io/all-incidents/polinrider-campaign-dprk-linked-supply-chain-attack-infects-github-repositories)
- [OpenSourceMalware/PolinRider — technical dossier on the DPRK threat actor](https://github.com/OpenSourceMalware/PolinRider)
- [DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains (JADESNOW / UNC5342)](https://cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding)
- [North Korean Hackers Use EtherHiding to Hide Malware Inside Blockchain Smart Contracts](https://thehackernews.com/2025/10/north-korean-hackers-use-etherhiding-to.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0846