# PolinRider: North Korea-Linked Supply Chain Campaign Expands Across npm, Packagist, Go Modules, and Chrome Extensions

> North Korean state-sponsored threat actors tied to the Contagious Interview / Famous Chollima cluster are running an expanding supply-chain campaign, PolinRider, that has published 162 malicious release artifacts across 108 packages and extensions on npm, Packagist, Go modules, and the Chrome Web Store. Loaders are hidden via whitespace padding, fake .woff2 font files, and invisible Unicode padding, triggered through malicious VS Code task files and git history rewriting, and use public blockchain RPC infrastructure (TRON, Aptos, BNB Smart Chain) as an immutable C2 dead-drop to fetch DEV#POPPER and OmniStealer for credential, browser-data, and crypto-wallet theft.

- **Published:** 2026-07-01T00:00:00Z
- **Last reviewed:** 2026-07-01T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1120
- **ID:** TL-2026-1120
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** Contagious Interview (North Korea)
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)

## Description

PolinRider is an active, expanding supply-chain compromise campaign attributed to North Korean (DPRK) state-sponsored threat actors operating under the broadly-tracked Contagious Interview / Famous Chollima activity cluster (also documented by MITRE ATT&CK as Group G1052, alias DeceptiveDevelopment, Gwisin Gang, Tenacious Pungsan, DEV#POPPER, PurpleBravo, and TAG-121). As of the 2026-07-01 Socket.dev disclosure, the campaign has published 162 malicious release artifacts across 108 unique packages and extensions spanning npm, Packagist (Composer/PHP), Go modules, and the Chrome Web Store, building on independent tracking by the OpenSourceMalware research team, which had separately confirmed 1,951 compromised GitHub repositories belonging to 1,047 unique owners as of April 2026 under the same threat-actor toolchain, including a merged sub-campaign known as TasksJacker.

Initial access is achieved through two overlapping vectors: (1) classic Contagious Interview social engineering, in which a fake company persona (e.g., 'ShoeVista') issues a trojanized MERN-stack take-home coding assessment to job-seeking developers, and (2) direct compromise of legitimate GitHub maintainer accounts and Packagist namespaces (e.g., Xpos587, 7span/sevenspan, Artiffusion-Inc), potentially via expired-domain takeover or account-recovery abuse, allowing the actor to publish trojanized package versions trusted by downstream consumers.

The loader itself is obfuscated JavaScript hidden using whitespace padding that pushes malicious code beyond the default editor viewport, fake .woff2 font files that are actually JavaScript (file-type masquerading), and invisible Unicode byte sequences (zero-width space U+200B / variation selectors) used as further padding/obfuscation. Execution is triggered automatically via malicious .vscode/tasks.json files configured with runOn: folderOpen and hide: true, or via postinstall hooks that append obfuscated code to common build config files (tailwind.config.js, postcss.config.mjs, vite.config.js, eslint.config.mjs, next.config.mjs, babel.config.js, astro.config.mjs). The actor further evades detection and complicates incident response by rewriting git history, force-pushing and back-dating commits so tampered code appears older than it is, rendering the visible commit history and GitHub UI unreliable for triage.

Once triggered, the loader uses a blockchain dead-drop C2 mechanism: it queries public RPC infrastructure for TRON (trongrid.io / api.trongrid.io), falling back to Aptos (fullnode.mainnet.aptoslabs.com) and BNB Smart Chain (bsc-dataseed.binance.org, bsc-rpc.publicnode.com), extracting attacker-controlled data embedded in transaction input fields after a '?.?' marker, XOR-decoding the extracted payload, and executing it inline via eval() or in a detached node -e process. Because blockchain transactions are immutable and append-only, this dead-drop infrastructure cannot be taken down by defenders or registrars. Observed follow-on payloads include DEV#POPPER (command execution and socket.io-client-based C2), OmniStealer (a Python-based stealer targeting 60+ browser crypto-wallet extensions, password managers, cloud storage credentials, and browser session data, linked to roughly 300,000 stolen credentials per Ransom-ISAC), BeaverTail (a JavaScript infostealer delivered via the tailwind-autoanimation package), and InvisibleFerret (a cross-platform modular RAT, MITRE ATT&CK S1245).

The campaign forms part of a broader, coordinated 2026 wave of DPRK-linked open-source supply-chain operations targeting multiple ecosystems in parallel, including the PHP/Packagist-focused 'JADESNOW' activity and the PyPI-focused 'Shai-Hulud' (Miasma Worm) campaign, indicating a deliberate, resourced effort to compromise software supply chains across every major package ecosystem simultaneously. Confirmed victims include government agencies in Bangladesh and the United States, cybersecurity firms, and defense contractors, in addition to individual software developers targeted directly through fake recruitment lures.

## MITRE ATT&CK

- T1608 Stage Capabilities
- T1195 Supply Chain Compromise
- T1199 Trusted Relationship
- T1566 Phishing
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1176 Software Extensions
- T1098 Account Manipulation
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1140 Deobfuscate/Decode Files or Information
- T1070 Indicator Removal
- T1082 System Information Discovery
- T1217 Browser Information Discovery
- T1083 File and Directory Discovery
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1539 Steal Web Session Cookie
- T1528 Steal Application Access Token
- T1005 Data from Local System
- T1119 Automated Collection
- T1102 Web Service
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1573 Encrypted Channel
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service

## Sources

- [PolinRider: North Korea-Linked Supply Chain Campaign Expands](https://socket.dev/blog/polinrider-north-korea-linked-supply-chain-campaign-expands)
- [Malpedia Library entry - PolinRider](https://malpedia.caad.fkie.fraunhofer.de/library/4a918368-950b-48ff-ba51-b4965274879b/)
- [North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign](https://thehackernews.com/2026/07/north-korean-hackers-publish-108.html)
- [North Korea-Linked Hackers Hide JavaScript Loaders in Open Source Repositories](https://cybersecuritynews.com/north-korea-linked-hackers-hide-javascript-loaders/)
- [Active Exploitation Alert: North Korean PolinRider Supply Chain Attack Targets npm, Packagist, Go Modules, and Chrome Extensions](https://www.rescana.com/post/active-exploitation-alert-north-korean-polinrider-supply-chain-attack-targets-npm-packagist-go-modules-and-chrome-extens)
- [Hackers Compromise GitHub Maintainer Accounts to Publish PolinRider-Infected Package Versions](https://gbhackers.com/github-maintainer-accounts/)
- [OpenSourceMalware/PolinRider - technical dossier](https://github.com/OpenSourceMalware/PolinRider)
- [PolinRider Rides Again: North Korean Attack Expands Across GitHub](https://opensourcemalware.com/blog/polinrider-rides-again)
- [PolinRider: DPRK Threat Actor That Compromised Hundreds of GitHub Repos Is Unmasked](https://opensourcemalware.com/blog/polinrider-attack)
- [DEV#POPPER RAT and OmniStealer (Everyday I'm Shufflin')](https://www.esentire.com/blog/north-korean-apt-malware-analysis-dev-popper-rat-and-omnistealer-everyday-im-shufflin)
- [Omnistealer uses the blockchain to steal everything it can](https://www.malwarebytes.com/blog/news/2026/04/omnistealer-uses-the-blockchain-to-steal-everything-it-can)
- [Contagious Interview, DeceptiveDevelopment, Gwisin Gang, Tenacious Pungsan, DEV#POPPER, PurpleBravo, TAG-121, Group G1052](https://attack.mitre.org/groups/G1052/)
- [InvisibleFerret, Software S1245](https://attack.mitre.org/software/S1245/)
- [Hijacked npm Packages Use Novel VSCode Autorun and Blockchain Dead Drops to Deploy a Credential/Crypto Stealer](https://research.jfrog.com/post/hijacked-npm-vscode-tasks-blockchain/)
- [RATatouille: A Malicious Recipe Hidden in rand-user-agent (Supply Chain Compromise)](https://www.aikido.dev/blog/catching-a-rat-remote-access-trojian-rand-user-agent-supply-chain-compromise)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1120