# PolinRider: DPRK Supply-Chain Campaign Hides BeaverTail/InvisibleFerret Malware in JS Build Config Files (tailwind.config.js et al.)

> A DPRK/Lazarus-aligned actor tracked as PolinRider compromises npm, Packagist, and Go module packages whose postinstall/build hooks append obfuscated JavaScript to common build config files (tailwind.config.js, postcss.config.mjs, eslint.config.mjs, next.config.mjs, babel.config.js, app.js), loading a BeaverTail stager and a cross-platform InvisibleFerret RAT that steal browser credentials, SSH keys, cloud/npm/GitHub tokens, and cryptocurrency wallets. As of 2026-04-11 the campaign had compromised 1,951 public GitHub repositories across 1,047 unique owners; a follow-on wave published 108 additional malicious packages/extensions across npm, Packagist, Go modules, and the Chrome Web Store as of 2026-07.

- **Published:** 2026-06-21T00:00:00Z
- **Last reviewed:** 2026-06-21T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1143
- **ID:** TL-2026-1143
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** PolinRider (North Korea)
- **Detections:** 9 · **IOCs:** 53 (full data via the Threadlinqs MCP server — Purple tier)

## Description

PolinRider is a DPRK/Lazarus-aligned supply-chain operation, first flagged by the OpenSourceMalware (OSM) research team in March 2026, that merges the previously tracked 'TasksJacker' and 'Contagious Interview' activity clusters. The actor compromises legitimate npm, Packagist, and Go module packages (and, in the July 2026 wave, a Chrome Web Store extension) so that their install/build lifecycle silently appends obfuscated JavaScript to the end of widely-used JS/TS build configuration files — tailwind.config.js, postcss.config.mjs, eslint.config.mjs, next.config.mjs, babel.config.js, and app.js — after the file's legitimate content, so the payload executes automatically the next time any build tool (webpack, Vite, Next.js, PostCSS, ESLint) imports the module. A second delivery vector abuses `.vscode/tasks.json` with `"runOn": "folderOpen"` to gain code execution the moment a victim opens an infected repository folder in VS Code, and a third vector masquerades JavaScript payloads as binary `.woff2` font files.

Once triggered, the loader fingerprints the host OS, then reaches out to public blockchain RPC infrastructure (TRON, Aptos, and BNB Smart Chain — the 'EtherHiding'/blockchain dead-drop technique also seen elsewhere in DPRK tradecraft) to retrieve an encrypted second-stage payload, decrypts it with an embedded XOR key, and executes it via `eval()`. This delivers an updated variant of the BeaverTail JavaScript stager, which in turn downloads a Python interpreter and the InvisibleFerret cross-platform RAT (a three-component Python backdoor: downloader, main payload with fingerprinting/remote-control/keylogging/exfiltration, and a dedicated browser-credential stealer). Follow-on payloads observed in the campaign include the Node.js RAT DEV#POPPER (multi-operator command queues, socket.io-client C2, `/verify-human/[VERSION]` heartbeat and `/u/f` file-upload endpoints, Node.js module-search-order hijacking via a hidden `.node_modules` folder, and sandbox/CI evasion) and OmniStealer (browser data, session cookie, and cryptocurrency wallet exfiltration, also over socket.io-client).

The actor further obfuscates its footprint using a 'Glassworm' technique — invisible zero-width Unicode and Private-Use-Area characters embedded in source to hide encrypted bytecode from code review and diff tools — and a 'ForceMemo' technique that uses stolen GitHub tokens to rebase malicious commits into repository history with falsified author/committer dates, evading standard review. A destructive companion behavior observed on 2026-05-27 force-pushes a single collapsed commit across all branches of compromised repositories, destroying divergent branch history (recoverable only via the GitHub Events API within its ~48-hour retention window).

Campaign scale grew from 675 repositories / 352 owners (2026-03-08) to 1,951 repositories / 1,047 owners (2026-04-11), with a compromised GitHub account (Xpos587) and organization (7span/sevenspan) used to push malicious Go modules and Packagist packages, and a synchronized bulk-modification wave across the Xpos587 account on 2026-06-23 at 10:00 UTC. A subsequent, distinct wave publishing 108 new malicious packages/extensions (162 release artifacts: 19 npm libraries, 10 Packagist packages, 61 Go modules... and 80 Go modules per Socket's count, plus one Chrome extension) across npm, Packagist, Go modules, and the Chrome Web Store was reported 2026-07-06/07. PolinRider overlaps infrastructure, tooling (AnyDesk, Astrill VPN), and an operator email (hundredup2023@gmail.com) with the related PurpleBravo/PurpleDelta clusters, and is attributed with high confidence to DPRK state-sponsored actors tracked elsewhere as Lazarus Group, Famous Chollima, Void Dokkaebi, CL-STA-0240, and Tenacious Pungsan — part of the broader 'Contagious Interview' operation that also uses fake recruiter personas and weaponized take-home coding assessments to compromise individual developers directly.

## MITRE ATT&CK

- T1583.001 Domains
- T1585.001 Social Media Accounts
- T1587.001 Malware
- T1608.001 Upload Malware
- T1588.002 Tool
- T1195 Supply Chain Compromise
- T1195.001 Compromise Software Dependencies and Development Tools
- T1195.002 Compromise Software Supply Chain
- T1566.002 Spearphishing Link
- T1566.003 Spearphishing via Service
- T1059.007 JavaScript
- T1059.006 Python
- T1204.002 Malicious File
- T1129 Shared Modules
- T1547.001 Registry Run Keys / Startup Folder
- T1554 Compromise Host Software Binary
- T1134.001 Token Impersonation/Theft
- T1027 Obfuscated Files or Information
- T1027.013 Encrypted/Encoded File
- T1036.008 Masquerade File Type
- T1070 Indicator Removal
- T1140 Deobfuscate/Decode Files or Information
- T1555.003 Credentials from Web Browsers
- T1552.001 Credentials In Files
- T1552.004 Private Keys
- T1056.001 Keylogging
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1087 Account Discovery
- T1518 Software Discovery
- T1005 Data from Local System
- T1119 Automated Collection
- T1102.002 Bidirectional Communication
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1565.001 Stored Data Manipulation

## Sources

- [I found a malware hiding in my tailwindcss config file](https://infosecwriteups.com/i-found-north-korean-dprk-malware-hiding-in-my-tailwind-config-js-45af2283742c)
- [North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign](https://thehackernews.com/2026/07/north-korean-hackers-publish-108.html)
- [PolinRider: DPRK Threat Actor That Compromised Hundreds of GitHub Repos Is Unmasked](https://opensourcemalware.com/blog/polinrider-attack)
- [PolinRider — technical dossier](https://github.com/OpenSourceMalware/PolinRider)
- [Malware Analysis: Tailwind CSS Config Malware](https://malpedia.caad.fkie.fraunhofer.de/library/bec155f2-d41d-480d-815e-56b13c1cbcd0/)
- [PolinRider: North Korea-Linked Supply Chain Campaign Expands](https://socket.dev/blog/polinrider-north-korea-linked-supply-chain-campaign-expands)
- [PolinRider Campaign: DPRK-Linked Supply Chain Attack Infects GitHub Repositories](https://threats.wiz.io/all-incidents/polinrider-campaign-dprk-linked-supply-chain-attack-infects-github-repositories)
- [PolinRider Rides Again: North Korean Attack Expands Across GitHub](https://opensourcemalware.com/blog/polinrider-rides-again)
- [Active Exploitation Alert: North Korean PolinRider Supply Chain Attack Targets npm, Packagist, Go Modules, and Chrome Extensions](https://www.rescana.com/post/active-exploitation-alert-north-korean-polinrider-supply-chain-attack-targets-npm-packagist-go-modules-and-chrome-extens)
- [PolinRider](https://www.mallory.ai/malware/019cd938-8511-7560-a9ca-2921a859df50)
- [The Invisible Patch: How PolinRider Rewrites Git History to Hide North Korean Malware](https://securityonline.info/polinrider-dprk-malware-github-history-falsification/)
- [Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers to Install New Variants of BeaverTail and InvisibleFerret Malware](https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/)
- [PurpleBravo's Targeting of the IT Software Supply Chain](https://www.recordedfuture.com/research/purplebravos-targeting-it-software-supply-chain)
- [Operation PolinRider: The Complete Developer's Guide to Detection, Containment, and Recovery](https://medium.com/@edawarekaro/operation-polinrider-the-complete-developers-guide-to-detection-containment-and-recovery-c3454bd660e3)
- [Surviving PolinRider: How to Recover Your GitHub Repositories After a Mass Force-Push Attack](https://medium.com/@edawarekaro/surviving-polinrider-how-to-recover-your-github-repositories-after-a-mass-force-push-attack-ebe8175124a0)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1143