North Korea-Linked "Contagious Interview"/Famous Chollima Actors Hide JavaScript Loaders (PolinRider) in Open-Source Packages — Threadlinqs Intelligence
As of 2026-07-05, North Korea-Linked "Contagious Interview"/Famous Chollima Actors Hide JavaScript Loaders (PolinRider) in Open-Source Packages is a high-severity supply chain threat attributed to WageMole (North Korea), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 30 indicators of compromise.
Threat ID: TL-2026-1111 · Severity: HIGH · Status: ACTIVE · Category: SUPPLY_CHAIN
Attribution: WageMole · North Korea · FINANCIAL
North Korean state-linked actors tied to the Contagious Interview / Famous Chollima activity clusters compromised the Xpos587 GitHub maintainer account and other maintainers to distribute a JavaScript
PolinRider is an ongoing JavaScript loader supply-chain campaign attributed with medium confidence to the North Korea-aligned Famous Chollima cluster (also tracked as Contagious Interview, Void Dokkaebi, DeceptiveDevelopment, Wagemole, and related aliases). The operation compromises legitimate maintainer accounts on GitHub and downstream package registries -- observed against the Xpos587 GitHub account, the Artiffusion-Inc/mirofish repository, and the 7span (sevenspan) Packagist organization -- and uses that trusted access to push obfuscated JavaScript loader code into otherwise legitimate open-source releases spanning npm, Packagist, Go modules, and at least one Chrome extension. Socket's Threat Research Team catalogued 162 malicious release artifacts across 108 unique packages, including roughly 80 Go modules, 10 Packagist packages, one Chrome extension, and a smaller set of npm packages.
The loader is concealed using two primary techniques: (1) obfuscated, whitespace-padded one-line JavaScript embedded inside legitimate-looking configuration files such as vite.config.js, eslint.config.js, and other *config.js files, positioned beyond the default editor/diff viewport so reviewers do not see it; and (2) a fully obfuscated JavaScript loader disguised as a fake .woff2 web-font asset (e.g. public/fonts/fa-solid-400.woff2), a file type security tooling commonly treats as an inert binary and skips during review. Execution is achieved without any build step or explicit developer action: a modified .vscode/tasks.json file defines a hidden task configured with "runOn": "folderOpen", which VS Code automatically executes -- passing the fake font asset to Node.js -- the moment a developer opens the compromised project folder.
Once running, the loader reaches out to blockchain RPC services on TRON, Aptos, and BNB Smart Chain, using them as an immutable, takedown-resistant dead-drop resolver to retrieve an encrypted second-stage payload. The retrieved material is decrypted with embedded XOR keys and executed via eval(). Observed second-stage payloads are DEV#POPPER, a remote-access/command-execution implant associated with the broader Famous Chollima toolset, and OmniStealer, an information stealer that targets browser-stored data and cryptocurrency wallets. Both communicate with attacker-controlled infrastructure using the socket.io-client library for command-and-control. Because the loader architecture is modular, researchers assess it is capable of delivering additional malware beyond the two payloads currently observed.
The operators additionally manipulate Git history -- using force pushes and backdated/antedated commits -- to make the malicious insertions appear older than their actual publish date, undermining the reliability of GitHub's commit-history and "last updated" indicators as a triage signal. Coordinated modification of multiple Xpos587-linked repositories (git2md, markfetch) and Artiffusion-Inc/mirofish occurred within a narrow window on 2026-06-23 at 10:00 UTC, consistent with automated, scripted publishing rather than manual, one-off tampering. The 7span/react-list Packagist package was compromised and remediated earlier, on 2026-05-16, indicating the campaign has been active across multiple waves and ecosystems over at least several months.
Attribution rests on TTP overlap with previously documented Famous Chollima / Contagious Interview activity: fake-recruiter social engineering of developers, abuse of VS Code auto-execution and workspace trust, and heavy targeting of cryptocurrency wallets, password-manager stores, and CI/CD secrets -- documented by Microsoft, CrowdStrike, Huntress, and Trend Micro in related campaigns using malware such as BeaverTail, InvisibleFerret, OtterCookie, PylangGhost, and GolangGhost. Organizations that installed any affected package version should treat the developer environment as compromised: preserve forensic artifacts, rebuild from known-good lockfiles, rotate all exposed secrets
Weaknesses (CWE)
CWE-506, CWE-829, CWE-494
Target sectors: technology, software development, cryptocurrency, finance, open source ecosystem
Target regions: Global
Detections & IOCs
As of 2026-07-20, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 30 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1583.001, T1608.001, T1585.001, T1195.001, T1199, T1566.002, T1204.002, T1059.007, T1554, T1098