PolinRider DPRK Supply-Chain Campaign: Confirmed GitHub Footprint Grows 6.5x Since March (JADESNOW/Beavertail/InvisibleFerret Loaders, DEV#POPPER & OmniStealer Payloads) — Threadlinqs Intelligence
As of 2026-07-17, PolinRider DPRK Supply-Chain Campaign: Confirmed GitHub Footprint Grows 6.5x Since March (JADESNOW/Beavertail/InvisibleFerret Loaders, DEV#POPPER & OmniStealer Payloads) is a high-severity supply chain threat attributed to PolinRider (Lazarus Group (North Korea (DPRK)), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 49 indicators of compromise.
Threat ID: TL-2026-1435 · Severity: HIGH · Status: ACTIVE · Category: SUPPLY_CHAIN
Attribution: PolinRider (Lazarus Group · North Korea (DPRK) · FINANCIAL
PolinRider, a DPRK-linked threat actor tied to the Contagious Interview / Famous Chollima cluster, has implanted obfuscated JavaScript loaders (tracked as JADESNOW, delivering Beavertail and
PolinRider is an active, expanding DPRK state-sponsored supply-chain compromise campaign first disclosed in March 2026 by the OpenSourceMalware (OSM) research team and further detailed by Socket's Threat Research Team in July 2026. The campaign is attributed to North Korean threat actors operating within the broader Contagious Interview / Famous Chollima activity cluster (which also encompasses DeceptiveDevelopment, Operation Dream Job, and ClickFake Interview), and shares strong infrastructure and tooling overlaps with the previously tracked TasksJacker campaign, indicating repurposed state-sponsored infrastructure across multiple named operations.
The campaign began no later than December 2025/January 2026 (anti-dated malicious commits were inserted into 7span/sevenspan-maintained repositories as early as January 8, 2026) and has escalated steadily: 675 repositories across 352 owners were confirmed compromised at initial disclosure (March 8, 2026); by April 11-12, 2026 that grew nearly 3x to 1,951 repositories across 1,047 unique owners (~930 individuals, ~117 organizations); by July 2026 Socket confirmed cross-ecosystem expansion representing an overall 6.5x growth in confirmed footprint since the March baseline, with 162 malicious release artifacts identified across 108-111 unique packages and extensions spanning npm, Packagist (10 PHP packages under the sevenspan namespace), Go modules (80+ modules, 61 confirmed distinct malicious versions), and Chrome/browser extensions (1-2 identified).
The attackers use several parallel initial-access vectors. First, they compromise legitimate maintainer GitHub accounts (via account takeover, likely including expired-domain takeover of maintainer emails) and inject malicious commits directly into trusted repositories, frequently rewriting git history and force-pushing with anti-dated timestamps via a Windows batch script (temp_auto_push.bat / config.bat variant) to make the malicious changes appear to predate detection tooling and to bypass pre-commit hooks. Second, they distribute trojanized VS Code extensions and weaponized take-home coding-assessment repositories disguised as legitimate technical interview projects for job candidates (two identified templates: "ShoeVista", an e-commerce MERN-stack test targeting full-stack developers, and "StakingGame", a blockchain deployment test targeting Web3 developers, UUID e9b53a7c-2342-4b15-b02d-bd8b8f6a03f9). These projects embed `.vscode/tasks.json` configuration files with `"runOn": "folderOpen"` triggers that automatically execute Node.js/shell commands (curl | bash patterns) the moment the victim opens the project folder in VS Code, without requiring any further user interaction.
Once triggered, the initial loader — heavily obfuscated JavaScript appended after valid content in legitimate build/config files (postcss.config.js, vite.config.js, eslint.config.js, tailwind config files) — is padded with excessive whitespace to push the malicious code beyond the default editor screen width, hiding it from casual code review. The loader implements a custom "4-layer shuffle-cipher" decoder identified by variant markers `rmcej%otb%` (original variant) or `Cot%3t=shtP` (rotated variant), plus an additional loader signature `_$_1e42`. A second concealment technique embeds JavaScript payloads inside files disguised as WOFF2 web font binaries (fake .woff2 files) to evade static and signature-based security scanning.
The loader's second stage retrieves encrypted payload material from immutable, attacker-controlled transactions recorded on public blockchain/RPC infrastructure — TRON, Aptos, and BNB Smart Chain — functioning as a resilient, takedown-resistant dead-drop C2 channel. Retrieved payloads are decrypted using embedded XOR keys (`2[gWfGj;<:-93Z^C` and `m6:tTh^D)cBz?NM]`) and executed directly via JavaScript `eval()`. This blockchain dead-drop technique is functionally identical to JADESNOW-class loaders and overlaps with prior Lazarus Grou
Weaknesses (CWE)
CWE-506, CWE-829, CWE-494
Target sectors: technology, software-development, cryptocurrency, fintech, open-source-ecosystem
Target regions: Global
Detections & IOCs
As of 2026-08-17, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 49 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1593, T1585, T1586, T1587, T1584, T1583, T1195, T1566, T1199, T1059
