# PolinRider Campaign: North Korea-Linked Supply Chain Attack Expands Across npm, Packagist, Go Modules, and Chrome Web Store (DEV#POPPER / OmniStealer)

> Socket.dev's July 1, 2026 disclosure tracks PolinRider, a DPRK-attributed supply-chain campaign (Contagious Interview / Famous Chollima / TAG-121 cluster) that has compromised 162 malicious release artifacts across 108 unique packages spanning npm, Packagist, Go modules, and a Chrome extension. Operators hijacked maintainer accounts, force-pushed anti-dated git history to conceal backdoored commits, and delivered DEV#POPPER RAT and OmniStealer credential/wallet-theft malware via obfuscated JavaScript loaders, fake .woff2 font payloads, and VS Code `folderOpen` task auto-run triggers.

- **Published:** 2026-07-01T00:00:00Z
- **Last reviewed:** 2026-07-01T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1055
- **ID:** TL-2026-1055
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** PolinRider (North Korea)
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

PolinRider is a DPRK state-sponsored software-supply-chain intrusion set operating within the broader Contagious Interview / Famous Chollima / DeceptiveDevelopment activity cluster tracked by MITRE ATT&CK as Group G1052 (aliases: Gwisin Gang, Tenacious Pungsan, DEV#POPPER, PurpleBravo, TAG-121). The cluster's core tradecraft blends fake-recruiter social engineering ("Contagious Interview") — luring software engineers via LinkedIn, Fiverr, and Upwork into cloning weaponized take-home coding-assessment repositories (observed lure projects: ShoeVista, a MERN e-commerce template, and StakingGame, a Web3 staking assessment) — with mass, opportunistic compromise of legitimate open-source maintainer accounts and npm/Packagist/Go-module publishing credentials.

Since first public dossier coverage in March 2026 (OpenSource Malware Project), the campaign has undergone rapid iteration: an initial wave (675 repos / 352 owners, obfuscator signature `rmcej%otb%`) was followed by an April 2026 variant rotation (1,951 repos / 1,047 owners, 2.9x growth in five weeks, new signature `Cot%3t=shtP`) after npm partially remediated the `tailwind-mainanimation` package. The campaign now documented in the July 1, 2026 Socket.dev report represents further expansion: 162 malicious release artifacts across 108 unique packages spanning npm, Packagist (PHP, via the `sevenspan`/`7span` namespace), 80+ Go modules, and at least one Chrome Web Store extension, plus additional malicious VS Code Marketplace extensions identified in adjacent June 2026 reporting (ByteBinTools.jupyter-powerdev, ToolCraft.jupyter-powertools, OLDev.markdown-mode-devtools).

Initial access to the supply chain is achieved by two parallel tracks: (1) takeover of legitimate maintainer GitHub accounts and organizations (observed: `Xpos587` personal account maintaining `git2md` and `markfetch`; `7span`/`Artiffusion-Inc` organization maintaining `react-list` and `mirofish`) via credential theft or session-token compromise, and (2) direct malicious-package publication to registries under attacker-controlled or freshly-created maintainer identities (npm publishers `allavin`, `blackedward` — subsequently deleted by npm trust & safety).

Once access is obtained, operators inject heavily obfuscated JavaScript payloads into widely-imported build/config files — `postcss.config.mjs`, `tailwind.config.js`, `eslint.config.mjs`, `vite.config.js`, `webpack.config.js`, `next.config.mjs`, `vue.config.js`, `gridsome.config.js`, and `truffle.js` — exploiting the fact that these files execute automatically during build/dev-server startup. A second delivery channel disguises the payload inside fake `.woff2` web-font files that are `require()`d/imported as though they were font assets, evading reviewers who skim diffs expecting binary font blobs. A third channel plants `.vscode/tasks.json` files configured with `runOn: folderOpen`, so simply opening the cloned/cleaned repository folder in VS Code silently auto-executes attacker shell commands — no build step or `npm install` required.

To hide the tampering from git history review, PolinRider operators run a `temp_auto_push.bat` batch script (found verbatim in 101+ victim repositories) that: (1) reads the original commit's author, email, and timestamp; (2) rewinds the local system clock to match that original commit time; (3) amends the commit with the injected malicious diff; and (4) force-pushes the amended history to the remote, using `git commit --amend`/`push --force` with pre-commit hook bypass flags. Because the system clock is rewound during the amend, the rewritten commit's timestamp is indistinguishable from the legitimate original in `git log`, defeating casual history review and many automated commit-timeline heuristics.

The obfuscated loader itself is a multi-stage JavaScript dropper. It shuffles/deobfuscates itself via a keyed string-shuffle algorithm (decoder functions observed: `_$_1e42` in the original March variant, `MDy` in the April-rotation variant; global injection markers `global['!']` and `global['_V']='8-stNN'` respectively), then XOR-decrypts (observed key: `2[gWfGj;<:-93Z^C`) and `eval()`s a second-stage payload. Rather than hardcoding traditional C2 domains/IPs, the loader primarily uses blockchain networks (TRON, Aptos, BNB Smart Chain) as a censorship-resistant, takedown-resistant dead-drop C2: it queries public blockchain RPC endpoints for specific wallet-address transaction memo/data fields, extracts an embedded encrypted URL or payload, and decrypts it locally. A secondary, more conventional HTTP C2 tier runs on short-lived Vercel-hosted subdomains (`default-configuration.vercel.app`, `260120.vercel.app`, `vscode-settings-bootstrap.vercel.app`, `vscode-settings-config.vercel.app`, `vscode-bootstrapper.vercel.app`, `vscode-load-config.vercel.app`) serving platform-specific payload variants at URL paths of the form `/settings/{mac|linux|win}?flag=<N>`. A directly observed raw IP:port C2 endpoint from an adjacent June 2026 Packagist-focused wave was `23.137.105.75:5173`.

Final-stage payloads delivered through this infrastructure include DEV#POPPER RAT (a remote access trojan first documented by Securonix, associated with the Contagious Interview cluster, providing interactive remote shell, file exfiltration, and keylogging) and OmniStealer (a credential, browser-data, and cryptocurrency-wallet stealer). MITRE ATT&CK's G1052 group profile additionally documents this cluster's use of BeaverTail (JavaScript-based initial-stage stealer/loader, S1246), InvisibleFerret (Python-based cross-platform backdoor/infostealer, S1245), XORIndex Loader (S1248, malicious-npm-package-specific loader), and HexEval Loader (S1249, JavaScript loader) as related or overlapping tooling within the same actor ecosystem — consistent with PolinRider's XOR-based loader design.

Persistence is achieved on Windows via Registry Run key modification (`T1547.001`) and on macOS/Linux via Launch Agents (`T1543.001`) and XDG autostart entries (`T1547.013`), in addition to the VS Code `folderOpen` task trigger which re-executes on every workspace open. Detection evasion techniques include multi-layer string obfuscation and encryption (`T1027`), pre-commit hook bypass flags to suppress local security tooling (`T1562`), sandbox/virtualization checks (`T1497`), and git history falsification (`T1070`-adjacent indicator removal via commit amendment) to defeat SOC and maintainer forensic review.

Detection pivots validated by the OpenSource Malware Project against the full compromised-repo corpus include GitHub code search for the filename `temp_auto_push.bat` (101 confirmed hits, 100% true-positive rate in their sample), the C2 string literal `default-configuration.vercel.app` (106 hits, ~0% false positives), and the obfuscator signature markers `rmcej%otb%` / `Cot%3t=shtP` / `global['_V']='8-` appearing inside otherwise-legitimate config files.

## MITRE ATT&CK

- T1593 Search Open Websites/Domains
- T1587 Develop Capabilities
- T1608 Stage Capabilities
- T1585 Establish Accounts
- T1583 Acquire Infrastructure
- T1195 Supply Chain Compromise
- T1195.001 Compromise Software Dependencies and Development Tools
- T1195.002 Compromise Software Supply Chain
- T1566 Phishing
- T1204 User Execution
- T1059.007 JavaScript
- T1059.003 Windows Command Shell
- T1059.006 Python
- T1547.001 Registry Run Keys / Startup Folder
- T1547.013 XDG Autostart Entries
- T1543.001 Launch Agent
- T1053.005 Scheduled Task
- T1027 Obfuscated Files or Information
- T1027.013 Encrypted/Encoded File
- T1036 Masquerading
- T1070 Indicator Removal
- T1685 Disable or Modify Tools
- T1497 Virtualization/Sandbox Evasion
- T1564 Hide Artifacts
- T1555 Credentials from Password Stores
- T1110 Brute Force
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1571 Non-Standard Port
- T1573.001 Symmetric Cryptography
- T1090 Proxy
- T1219 Remote Access Tools
- T1041 Exfiltration Over C2 Channel
- T1567.002 Exfiltration to Cloud Storage
- T1657 Financial Theft

## Sources

- [PolinRider: North Korea-Linked Supply Chain Campaign Expands](https://socket.dev/blog/polinrider-north-korea-linked-supply-chain-campaign-expands?utm_medium=feed)
- [Socket PolinRider Live Tracking Page](https://socket.dev/supply-chain-attacks/polinrider)
- [PolinRider: DPRK Threat Actor That Compromised Hundreds of GitHub Repos Is Unmasked](https://opensourcemalware.com/blog/polinrider-attack)
- [PolinRider Rides Again: North Korean Attack Expands Across GitHub](https://opensourcemalware.com/blog/polinrider-rides-again)
- [PolinRider GitHub technical dossier (OpenSourceMalware)](https://github.com/OpenSourceMalware/PolinRider/blob/main/README.md)
- [Contagious Interview, DeceptiveDevelopment, Gwisin Gang, Tenacious Pungsan, DEV#POPPER, PurpleBravo, TAG-121, Group G1052](https://attack.mitre.org/groups/G1052/)
- [The Invisible Patch: How PolinRider Rewrites Git History to Hide North Korean Malware](https://securityonline.info/polinrider-dprk-malware-github-history-falsification/)
- [Famous Chollima Targets PHP Developers Through Compromised Packagist Package](https://socket.dev/blog/famous-chollima-targets-php-developers-through-compromised-packagist-package)
- [North Korean Hackers Are Turning Developer Tools Into Malware Delivery Channels](https://thehackernews.com/2026/06/north-korean-hackers-are-turning.html)
- [FAMOUS CHOLLIMA: DPRK employment fraud and developer-lure intrusion set](https://www.threatintelreport.com/2026/02/28/threat_actor_profiles/famous-chollima-dprk-employment-fraud-and-developer-lure-intrusion-set/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1055