PolinRider Campaign: North Korea-Linked Supply Chain Attack Expands Across npm, Packagist, Go Modules, and Chrome Web Store (DEV#POPPER / OmniStealer)
PolinRider Campaign (TL-2026-1055), also tracked as PolinRider, is a high-severity supply-chain compromise, first published 2026-07-01. It is attributed to PolinRider (North Korea) with high confidence, affects npm tailwindcss-style-animate, maps to 37 MITRE ATT&CK techniques (T1005, T1027, T1027.013), and is covered by 9 detection rules and 29 indicators of compromise.
Key facts for TL-2026-1055
- Threat ID
- TL-2026-1055
- Also known as
- PolinRider, TasksJacker
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-07-01
- Last reviewed
- 2026-07-01
- Attribution
- PolinRider
- Attribution confidence
- HIGH
- Nation-state nexus
- North Korea
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, open-source, cryptocurrency, finance
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 29
Malware and tooling in PolinRider Campaign
Malware and tooling: BeaverTail - S1246, DEV#POPPER RAT, InvisibleFerret - S1245, OmniStealer, HexEval Loader, XORIndex Loader
Socket.dev's July 1, 2026 disclosure tracks PolinRider, a DPRK-attributed supply-chain campaign (Contagious Interview / Famous Chollima / TAG-121 cluster) that has compromised 162 malicious release artifacts across 108 unique packages spanning npm, Packagist, Go modules, and a Chrome extension. Operators hijacked maintainer accounts, force-pushed anti-dated git history to conceal backdoored commits, and delivered DEV#POPPER RAT and OmniStealer credential/wallet-theft malware via obfuscated JavaScript loaders, fake .woff2 font payloads, and VS Code `folderOpen` task auto-run triggers.
How PolinRider Campaign works
PolinRider is a DPRK state-sponsored software-supply-chain intrusion set operating within the broader Contagious Interview / Famous Chollima / DeceptiveDevelopment activity cluster tracked by MITRE ATT&CK as Group G1052 (aliases: Gwisin Gang, Tenacious Pungsan, DEV#POPPER, PurpleBravo, TAG-121). The cluster's core tradecraft blends fake-recruiter social engineering ("Contagious Interview") — luring software engineers via LinkedIn, Fiverr, and Upwork into cloning weaponized take-home coding-assessment repositories (observed lure projects: ShoeVista, a MERN e-commerce template, and StakingGame, a Web3 staking assessment) — with mass, opportunistic compromise of legitimate open-source maintainer accounts and npm/Packagist/Go-module publishing credentials.
Since first public dossier coverage in March 2026 (OpenSource Malware Project), the campaign has undergone rapid iteration: an initial wave (675 repos / 352 owners, obfuscator signature `rmcej%otb%`) was followed by an April 2026 variant rotation (1,951 repos / 1,047 owners, 2.9x growth in five weeks, new signature `Cot%3t=shtP`) after npm partially remediated the `tailwind-mainanimation` package. The campaign now documented in the July 1, 2026 Socket.dev report represents further expansion: 162 malicious release artifacts across 108 unique packages spanning npm, Packagist (PHP, via the `sevenspan`/`7span` namespace), 80+ Go modules, and at least one Chrome Web Store extension, plus additional malicious VS Code Marketplace extensions identified in adjacent June 2026 reporting (ByteBinTools.jupyter-powerdev, ToolCraft.jupyter-powertools, OLDev.markdown-mode-devtools).
Initial access to the supply chain is achieved by two parallel tracks: (1) takeover of legitimate maintainer GitHub accounts and organizations (observed: `Xpos587` personal account maintaining `git2md` and `markfetch`; `7span`/`Artiffusion-Inc` organization maintaining `react-list` and `mirofish`) via credential theft or session-token compromise, and (2) direct malicious-package publication to registries under attacker-controlled or freshly-created maintainer identities (npm publishers `allavin`, `blackedward` — subsequently deleted by npm trust & safety).
Once access is obtained, operators inject heavily obfuscated JavaScript payloads into widely-imported build/config files — `postcss.config.mjs`, `tailwind.config.js`, `eslint.config.mjs`, `vite.config.js`, `webpack.config.js`, `next.config.mjs`, `vue.config.js`, `gridsome.config.js`, and `truffle.js` — exploiting the fact that these files execute automatically during build/dev-server startup. A second delivery channel disguises the payload inside fake `.woff2` web-font files that are `require()`d/imported as though they were font assets, evading reviewers who skim diffs expecting binary font blobs. A third channel plants `.vscode/tasks.json` files configured with `runOn: folderOpen`, so simply opening the cloned/cleaned repository folder in VS Code silently auto-executes attacker shell commands — no build step or `npm install` required.
To hide the tampering from git history review, PolinRider operators run a `temp_auto_push.bat` batch script (found verbatim in 101+ victim repositories) that: (1) reads the original commit's author, email, and timestamp; (2) rewinds the local system clock to match that original commit time; (3) amends the commit with the injected malicious diff; and (4) force-pushes the amended history to the remote, using `git commit --amend`/`push --force` with pre-commit hook bypass flags. Because the system clock is rewound during the amend, the rewritten commit's timestamp is indistinguishable from the legitimate original in `git log`, defeating casual history review and many automated commit-timeline heuristics.
The obfuscated loader itself is a multi-stage JavaScript dropper. It shuffles/deobfuscates itself via a keyed string-shuffle algorithm (decoder functions observed: `_$_1e42` in the original March variant, `MDy` in the April-rotation variant; global injection markers `global['!']` and `global['_V']='8-stNN'` respectively), then XOR-decrypts (observed key: `2[gWfGj;<:-93Z^C`) and `eval()`s a second-stage payload. Rather than hardcoding traditional C2 domains/IPs, the loader primarily uses blockchain networks (TRON, Aptos, BNB Smart Chain) as a censorship-resistant, takedown-resistant dead-drop C2: it queries public blockchain RPC endpoints for specific wallet-address transaction memo/data fields, extracts an embedded encrypted URL or payload, and decrypts it locally. A secondary, more conventional HTTP C2 tier runs on short-lived Vercel-hosted subdomains (`default-configuration.vercel.app`, `260120.vercel.app`, `vscode-settings-bootstrap.vercel.app`, `vscode-settings-config.vercel.app`, `vscode-bootstrapper.vercel.app`, `vscode-load-config.vercel.app`) serving platform-specific payload variants at URL paths of the form `/settings/{mac|linux|win}?flag=<N>`. A directly observed raw IP:port C2 endpoint from an adjacent June 2026 Packagist-focused wave was `23.137.105.75:5173`.
Final-stage payloads delivered through this infrastructure include DEV#POPPER RAT (a remote access trojan first documented by Securonix, associated with the Contagious Interview cluster, providing interactive remote shell, file exfiltration, and keylogging) and OmniStealer (a credential, browser-data, and cryptocurrency-wallet stealer). MITRE ATT&CK's G1052 group profile additionally documents this cluster's use of BeaverTail (JavaScript-based initial-stage stealer/loader, S1246), InvisibleFerret (Python-based cross-platform backdoor/infostealer, S1245), XORIndex Loader (S1248, malicious-npm-package-specific loader), and HexEval Loader (S1249, JavaScript loader) as related or overlapping tooling within the same actor ecosystem — consistent with PolinRider's XOR-based loader design.
Persistence is achieved on Windows via Registry Run key modification (`T1547.001`) and on macOS/Linux via Launch Agents (`T1543.001`) and XDG autostart entries (`T1547.013`), in addition to the VS Code `folderOpen` task trigger which re-executes on every workspace open. Detection evasion techniques include multi-layer string obfuscation and encryption (`T1027`), pre-commit hook bypass flags to suppress local security tooling (`T1562`), sandbox/virtualization checks (`T1497`), and git history falsification (`T1070`-adjacent indicator removal via commit amendment) to defeat SOC and maintainer forensic review.
Detection pivots validated by the OpenSource Malware Project against the full compromised-repo corpus include GitHub code search for the filename `temp_auto_push.bat` (101 confirmed hits, 100% true-positive rate in their sample), the C2 string literal `default-configuration.vercel.app` (106 hits, ~0% false positives), and the obfuscator signature markers `rmcej%otb%` / `Cot%3t=shtP` / `global['_V']='8-` appearing inside otherwise-legitimate config files.
MITRE ATT&CK techniques used in TL-2026-1055
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1027.013 Encrypted/Encoded File; T1036 Masquerading; T1070 Indicator Removal; T1497 Virtualization/Sandbox Evasion; T1564 Hide Artifacts
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567.002 Exfiltration to Cloud Storage
Persistence
T1053.005 Scheduled Task; T1543.001 Launch Agent; T1547.001 Registry Run Keys / Startup Folder; T1547.013 XDG Autostart Entries
Execution
T1059.003 Windows Command Shell; T1059.006 Python; T1059.007 JavaScript; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1090 Proxy; T1219 Remote Access Tools; T1571 Non-Standard Port; T1573.001 Symmetric Cryptography
Discovery
T1082 System Information Discovery; T1083 File and Directory Discovery
Credential Access
T1110 Brute Force; T1555 Credentials from Password Stores
Initial Access
T1195 Supply Chain Compromise; T1195.001 Compromise Software Dependencies and Development Tools; T1195.002 Compromise Software Supply Chain; T1566 Phishing
Resource Development
T1583 Acquire Infrastructure; T1585 Establish Accounts; T1587 Develop Capabilities; T1608 Stage Capabilities
Reconnaissance
T1593 Search Open Websites/Domains
Impact
defense-impairment
Affected products and versions in PolinRider Campaign
- npm — tailwindcss-style-animate
Vulnerable versions: 1.1.6
Fixed in: removed from registry - npm — tailwind-mainanimation
Vulnerable versions: 2.3.3
Fixed in: 0.0.1 security placeholder - npm — tailwind-autoanimation
Vulnerable versions: 2.3.6
Fixed in: removed from registry - npm — tailwind-animationbased
Vulnerable versions: all published versions
Fixed in: not confirmed - npm — tailwindcss-typography-style
Vulnerable versions: 0.8.2
Fixed in: not confirmed - npm — tailwindcss-style-modify
Vulnerable versions: 0.8.3
Fixed in: not confirmed - npm — tailwindcss-animate-style
Vulnerable versions: 1.2.5
Fixed in: not confirmed - Packagist — roberts/leads
Vulnerable versions: dev-drewroberts/feature/test-case
Fixed in: not confirmed - GitHub / npm — Xpos587/git2md
Vulnerable versions: commits force-pushed June 23, 2026
Fixed in: not confirmed - GitHub / npm — Xpos587/markfetch
Vulnerable versions: commits force-pushed June 23, 2026
Fixed in: not confirmed
Remediation for PolinRider Campaign
Patches
- No CVE/vulnerability patch applies; remediation is removal of malicious package versions and credential rotation, not a software patch
Immediate actions
- Search all repositories for the filename temp_auto_push.bat (101+ confirmed true-positive hits in prior campaign waves)
- Search build/config files (postcss.config.mjs, tailwind.config.js, eslint.config.mjs, vite.config.js, webpack.config.js, next.config.mjs, vue.config.js, gridsome.config.js, truffle.js) for appended obfuscated JS, the signature markers rmcej%otb% / Cot%3t=shtP, or global['_V']='8- assignments
- Search codebases for references to default-configuration.vercel.app, 260120.vercel.app, and the other listed Vercel C2 subdomains
- Audit .vscode/tasks.json in all cloned repositories for runOn:folderOpen triggers before opening any external/candidate-assessment repository in VS Code
- Block outbound connections to 23.137.105.75:5173 and the listed *.vercel.app C2 subdomains at the network egress layer
- Audit git history on maintainer-owned repositories for force-pushed/amended commits with suspicious clock-consistent timestamps, especially where local commit hooks were bypassed
- Rotate npm/Packagist/Go-module publishing credentials and enable 2FA/hardware-key-backed publish tokens for all maintainers
- Remove/quarantine the specific malicious npm packages (tailwindcss-style-animate, tailwind-mainanimation, tailwind-autoanimation, tailwind-animationbased, tailwindcss-typography-style, tailwindcss-style-modify, tailwindcss-animate-style) and the malicious VS Code extensions (ByteBinTools.jupyter-powerdev, ToolCraft.jupyter-powertools, OLDev.markdown-mode-devtools) if present in any environment
Workarounds
- Disable VS Code task auto-run (`task.allowAutomaticTasks: off` in workspace/user settings) globally to neutralize the folderOpen trigger vector
- Pin dependency versions and disable automatic minor/patch updates for the affected package families until upstream registries confirm remediation
Longer-term hardening
- Adopt package-lock/integrity pinning and reproducible-build verification for all npm/Packagist/Go dependencies
- Require signed commits and branch-protection rules that reject force-pushes on default branches for all organization repositories
- Deploy EDR/behavioral detection capable of flagging Node.js child-process spawning from build tooling and unexpected blockchain-RPC network calls from developer workstations
- Institute mandatory security review of any take-home coding-assessment repository before cloning to a corporate-managed device; use disposable/sandboxed VMs for candidate-interview code execution
- Train engineering staff on Contagious Interview social-engineering patterns (fake recruiter outreach via LinkedIn/Fiverr/Upwork directing to malicious take-home assessments)
Weaknesses (CWE) in PolinRider Campaign
CWE-506, CWE-494, CWE-829, CWE-1104
Timeline of PolinRider Campaign
- Anti-dated malicious commits identified in 7span-maintained repositories, force-pushed with a manipulated system clock to backdate the tampering into pre-existing legitimate commit history.
- OpenSource Malware Project publishes initial PolinRider dossier: 675 compromised public GitHub repositories across 352 unique owners, primary obfuscator signature rmcej%otb% observed.
- npm security team replaces the malicious tailwind-mainanimation package with a neutral v0.0.1 security placeholder release.
- OpenSource Malware Project detects a rotated obfuscator variant (new signature Cot%3t=shtP, decoder MDy) indicating active operator adaptation post-remediation.
- Follow-up hunt confirms 1,951 compromised public GitHub repositories across 1,047 unique owners (2.9x growth in five weeks) and discovers five additional Vercel-hosted C2 subdomains.
- 7span organization compromise identified and partially remediated after months of undetected anti-dated commit tampering.
- Socket.dev documents a related Famous Chollima wave specifically targeting PHP developers via the compromised Packagist package roberts/leads (dev-drewroberts/feature/test-case branch), delivering DEV#POPPER RAT.
- The Hacker News reports on the broader trend of DPRK actors weaponizing developer tooling (npm, Packagist, VS Code Marketplace) as malware delivery channels, citing a C2 endpoint at 23.137.105.75:5173 and three malicious VS Code extensions.
- Synchronized bulk modifications observed across Xpos587-maintained repositories (git2md, markfetch) at 10:00 UTC, indicating automated/scripted mass tampering rather than manual per-repo compromise.
- Socket.dev publicly discloses the expanded PolinRider campaign: 162 malicious release artifacts across 108 unique packages spanning npm, Packagist, 80+ Go modules, and a Chrome Web Store extension, formally attributing the activity to the Contagious Interview / Famous Chollima DPRK cluster.
Sources cited for PolinRider Campaign
- PolinRider: North Korea-Linked Supply Chain Campaign Expands
- Socket PolinRider Live Tracking Page
- PolinRider: DPRK Threat Actor That Compromised Hundreds of GitHub Repos Is Unmasked
- PolinRider Rides Again: North Korean Attack Expands Across GitHub
- PolinRider GitHub technical dossier (OpenSourceMalware)
- Contagious Interview, DeceptiveDevelopment, Gwisin Gang, Tenacious Pungsan, DEV#POPPER, PurpleBravo, TAG-121, Group G1052
- The Invisible Patch: How PolinRider Rewrites Git History to Hide North Korean Malware
- Famous Chollima Targets PHP Developers Through Compromised Packagist Package
- North Korean Hackers Are Turning Developer Tools Into Malware Delivery Channels
- FAMOUS CHOLLIMA: DPRK employment fraud and developer-lure intrusion set
Threats related to PolinRider Campaign
- PolinRider DPRK Supply-Chain Campaign: Confirmed GitHub Footprint Grows 6.5x Since March (JADESNOW/Beavertail/InvisibleFerret Loaders, DEV#POPPER & OmniStealer Payloads)
- ChainVeil and ViteVenom Malware Linked to DPRK PolinRider Supply-Chain Campaign
- PolinRider: DPRK Supply-Chain Campaign Hides BeaverTail/InvisibleFerret Malware in JS Build Config Files (tailwind.config.js et al.)
- PolinRider — DPRK Supply-Chain Campaign Compromises 1,951 GitHub Repos via Malicious npm Packages, VS Code tasks.json Auto-Run, and TRON/Aptos/BSC Blockchain Dead-Drop C2
- PolinRider: North Korea-Linked Supply Chain Campaign Expands Across npm, Packagist, Go Modules, and Chrome Extensions
- Famous Chollima (DPRK) Compromises Packagist Package roberts/leads dev Branch — tailwind.js Node.js Loader Uses TRON/Aptos/BNB Blockchain Dead-Drop C2 (EtherHiding-style)
Detection coverage for TL-2026-1055
As of 2026-07-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1055 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.