# North Korea-Linked "Contagious Interview"/Famous Chollima Actors Hide JavaScript Loaders (PolinRider) in Open-Source Packages

> North Korean state-linked actors tied to the Contagious Interview / Famous Chollima activity clusters compromised the Xpos587 GitHub maintainer account and other maintainers to distribute a JavaScript loader campaign dubbed PolinRider across npm, Packagist, Go module, and Chrome extension packages. The loaders deliver second-stage DEV#POPPER and OmniStealer payloads via blockchain-based (TRON, Aptos, BNB Smart Chain) dead-drop resolvers, targeting developer credentials, CI/CD secrets, and cryptocurrency wallets. Socket.dev's Threat Research Team identified 162 malicious release artifacts across 108 unique packages and extensions.

- **Published:** 2026-07-05T00:00:00Z
- **Last reviewed:** 2026-07-05T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1111
- **ID:** TL-2026-1111
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** WageMole (North Korea)
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

PolinRider is an ongoing JavaScript loader supply-chain campaign attributed with medium confidence to the North Korea-aligned Famous Chollima cluster (also tracked as Contagious Interview, Void Dokkaebi, DeceptiveDevelopment, Wagemole, and related aliases). The operation compromises legitimate maintainer accounts on GitHub and downstream package registries -- observed against the Xpos587 GitHub account, the Artiffusion-Inc/mirofish repository, and the 7span (sevenspan) Packagist organization -- and uses that trusted access to push obfuscated JavaScript loader code into otherwise legitimate open-source releases spanning npm, Packagist, Go modules, and at least one Chrome extension. Socket's Threat Research Team catalogued 162 malicious release artifacts across 108 unique packages, including roughly 80 Go modules, 10 Packagist packages, one Chrome extension, and a smaller set of npm packages.

The loader is concealed using two primary techniques: (1) obfuscated, whitespace-padded one-line JavaScript embedded inside legitimate-looking configuration files such as vite.config.js, eslint.config.js, and other *config.js files, positioned beyond the default editor/diff viewport so reviewers do not see it; and (2) a fully obfuscated JavaScript loader disguised as a fake .woff2 web-font asset (e.g. public/fonts/fa-solid-400.woff2), a file type security tooling commonly treats as an inert binary and skips during review. Execution is achieved without any build step or explicit developer action: a modified .vscode/tasks.json file defines a hidden task configured with "runOn": "folderOpen", which VS Code automatically executes -- passing the fake font asset to Node.js -- the moment a developer opens the compromised project folder.

Once running, the loader reaches out to blockchain RPC services on TRON, Aptos, and BNB Smart Chain, using them as an immutable, takedown-resistant dead-drop resolver to retrieve an encrypted second-stage payload. The retrieved material is decrypted with embedded XOR keys and executed via eval(). Observed second-stage payloads are DEV#POPPER, a remote-access/command-execution implant associated with the broader Famous Chollima toolset, and OmniStealer, an information stealer that targets browser-stored data and cryptocurrency wallets. Both communicate with attacker-controlled infrastructure using the socket.io-client library for command-and-control. Because the loader architecture is modular, researchers assess it is capable of delivering additional malware beyond the two payloads currently observed.

The operators additionally manipulate Git history -- using force pushes and backdated/antedated commits -- to make the malicious insertions appear older than their actual publish date, undermining the reliability of GitHub's commit-history and "last updated" indicators as a triage signal. Coordinated modification of multiple Xpos587-linked repositories (git2md, markfetch) and Artiffusion-Inc/mirofish occurred within a narrow window on 2026-06-23 at 10:00 UTC, consistent with automated, scripted publishing rather than manual, one-off tampering. The 7span/react-list Packagist package was compromised and remediated earlier, on 2026-05-16, indicating the campaign has been active across multiple waves and ecosystems over at least several months.

Attribution rests on TTP overlap with previously documented Famous Chollima / Contagious Interview activity: fake-recruiter social engineering of developers, abuse of VS Code auto-execution and workspace trust, and heavy targeting of cryptocurrency wallets, password-manager stores, and CI/CD secrets -- documented by Microsoft, CrowdStrike, Huntress, and Trend Micro in related campaigns using malware such as BeaverTail, InvisibleFerret, OtterCookie, PylangGhost, and GolangGhost. Organizations that installed any affected package version should treat the developer environment as compromised: preserve forensic artifacts, rebuild from known-good lockfiles, rotate all exposed secrets and tokens from a clean machine, and audit for hidden VS Code task auto-execution paths across all repositories.

## MITRE ATT&CK

- T1583.001 Domains
- T1608.001 Upload Malware
- T1585.001 Social Media Accounts
- T1195.001 Compromise Software Dependencies and Development Tools
- T1199 Trusted Relationship
- T1566.002 Spearphishing Link
- T1204.002 Malicious File
- T1059.007 JavaScript
- T1554 Compromise Host Software Binary
- T1098 Account Manipulation
- T1027 Obfuscated Files or Information
- T1036.008 Masquerade File Type
- T1070.006 Timestomp
- T1140 Deobfuscate/Decode Files or Information
- T1102.001 Dead Drop Resolver
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography
- T1552.001 Credentials In Files
- T1528 Steal Application Access Token
- T1555 Credentials from Password Stores
- T1115 Clipboard Data
- T1005 Data from Local System
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1518 Software Discovery
- T1041 Exfiltration Over C2 Channel

## Sources

- [North Korea-Linked Hackers Hide JavaScript Loaders in Open Source Repositories](https://cybersecuritynews.com/north-korea-linked-hackers-hide-javascript-loaders/)
- [PolinRider: North Korea-Linked Supply Chain Campaign Expands](https://socket.dev/blog/polinrider-north-korea-linked-supply-chain-campaign-expands)
- [North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign](https://thehackernews.com/2026/07/north-korean-hackers-publish-108.html)
- [Contagious Interview: Malware delivered through fake developer job interviews](https://www.microsoft.com/en-us/security/blog/2026/03/11/contagious-interview-malware-delivered-through-fake-developer-job-interviews/)
- [Famous Chollima Adversary Profile](https://www.crowdstrike.com/en-us/adversaries/famous-chollima/)
- [Famous Chollima Threat Actor Profile](https://www.huntress.com/threat-library/threat-actors/famous-chollima)
- [Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories](https://www.trendmicro.com/en_us/research/26/d/void-dokkaebi-uses-fake-job-interview-lure-to-spread-malware-via-code-repositories.html)
- [Famous Chollima deploying Python version of GolangGhost RAT](https://blog.talosintelligence.com/python-version-of-golangghost-rat/)
- [North Korea-Linked PolinRider Campaign Hits 108 Open Source Packages and Extensions](https://cyberpress.org/polinrider-supply-chain-attack/)
- [PolinRider supply chain attack expands to Packagist ecosystem](https://www.developer-tech.com/news/polinrider-supply-chain-attack-expands-packagist-ecosystem/)
- [Hackers Compromise GitHub Maintainer Accounts to Publish PolinRider-Infected Package Versions](https://gbhackers.com/github-maintainer-accounts/)
- [OpenSourceMalware/PolinRider research repository](https://github.com/OpenSourceMalware/PolinRider)
- [apache/superset issue: project targeted by the PolinRider supply-chain campaign](https://github.com/apache/superset/issues/39299)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1111