PolinRider Campaign: North Korea-Linked Supply Chain Attack Expands Across npm, Packagist, Go Modules, and Chrome Web Store (DEV#POPPER / OmniStealer) — Threadlinqs Intelligence
As of 2026-07-01, PolinRider Campaign: North Korea-Linked Supply Chain Attack Expands Across npm, Packagist, Go Modules, and Chrome Web Store (DEV#POPPER / OmniStealer) is a high-severity supply chain threat attributed to PolinRider (Contagious Interview (North Korea (DPRK)), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 29 indicators of compromise.
Threat ID: TL-2026-1055 · Severity: HIGH · Status: ACTIVE · Category: SUPPLY_CHAIN
Attribution: PolinRider (Contagious Interview · North Korea (DPRK) · FINANCIAL
Socket.dev's July 1, 2026 disclosure tracks PolinRider, a DPRK-attributed supply-chain campaign (Contagious Interview / Famous Chollima / TAG-121 cluster) that has compromised 162 malicious release
PolinRider is a DPRK state-sponsored software-supply-chain intrusion set operating within the broader Contagious Interview / Famous Chollima / DeceptiveDevelopment activity cluster tracked by MITRE ATT&CK as Group G1052 (aliases: Gwisin Gang, Tenacious Pungsan, DEV#POPPER, PurpleBravo, TAG-121). The cluster's core tradecraft blends fake-recruiter social engineering ("Contagious Interview") — luring software engineers via LinkedIn, Fiverr, and Upwork into cloning weaponized take-home coding-assessment repositories (observed lure projects: ShoeVista, a MERN e-commerce template, and StakingGame, a Web3 staking assessment) — with mass, opportunistic compromise of legitimate open-source maintainer accounts and npm/Packagist/Go-module publishing credentials.
Since first public dossier coverage in March 2026 (OpenSource Malware Project), the campaign has undergone rapid iteration: an initial wave (675 repos / 352 owners, obfuscator signature `rmcej%otb%`) was followed by an April 2026 variant rotation (1,951 repos / 1,047 owners, 2.9x growth in five weeks, new signature `Cot%3t=shtP`) after npm partially remediated the `tailwind-mainanimation` package. The campaign now documented in the July 1, 2026 Socket.dev report represents further expansion: 162 malicious release artifacts across 108 unique packages spanning npm, Packagist (PHP, via the `sevenspan`/`7span` namespace), 80+ Go modules, and at least one Chrome Web Store extension, plus additional malicious VS Code Marketplace extensions identified in adjacent June 2026 reporting (ByteBinTools.jupyter-powerdev, ToolCraft.jupyter-powertools, OLDev.markdown-mode-devtools).
Initial access to the supply chain is achieved by two parallel tracks: (1) takeover of legitimate maintainer GitHub accounts and organizations (observed: `Xpos587` personal account maintaining `git2md` and `markfetch`; `7span`/`Artiffusion-Inc` organization maintaining `react-list` and `mirofish`) via credential theft or session-token compromise, and (2) direct malicious-package publication to registries under attacker-controlled or freshly-created maintainer identities (npm publishers `allavin`, `blackedward` — subsequently deleted by npm trust & safety).
Once access is obtained, operators inject heavily obfuscated JavaScript payloads into widely-imported build/config files — `postcss.config.mjs`, `tailwind.config.js`, `eslint.config.mjs`, `vite.config.js`, `webpack.config.js`, `next.config.mjs`, `vue.config.js`, `gridsome.config.js`, and `truffle.js` — exploiting the fact that these files execute automatically during build/dev-server startup. A second delivery channel disguises the payload inside fake `.woff2` web-font files that are `require()`d/imported as though they were font assets, evading reviewers who skim diffs expecting binary font blobs. A third channel plants `.vscode/tasks.json` files configured with `runOn: folderOpen`, so simply opening the cloned/cleaned repository folder in VS Code silently auto-executes attacker shell commands — no build step or `npm install` required.
To hide the tampering from git history review, PolinRider operators run a `temp_auto_push.bat` batch script (found verbatim in 101+ victim repositories) that: (1) reads the original commit's author, email, and timestamp; (2) rewinds the local system clock to match that original commit time; (3) amends the commit with the injected malicious diff; and (4) force-pushes the amended history to the remote, using `git commit --amend`/`push --force` with pre-commit hook bypass flags. Because the system clock is rewound during the amend, the rewritten commit's timestamp is indistinguishable from the legitimate original in `git log`, defeating casual history review and many automated commit-timeline heuristics.
The obfuscated loader itself is a multi-stage JavaScript dropper. It shuffles/deobfuscates itself via a keyed string-shuffle algorithm (decoder functions observed: `_$_1e42` in the original March variant, `MDy` in the April-rotat
Weaknesses (CWE)
CWE-506, CWE-494, CWE-829, CWE-1104
Target sectors: technology, software-development, open-source, cryptocurrency, finance
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 29 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1593, T1587, T1608, T1585, T1583, T1195, T1195.001, T1195.002, T1566, T1204