PolinRider is an active, expanding DPRK state-sponsored supply-chain compromise campaign first disclosed in March 2026 by the OpenSourceMalware (OSM) research team and further detailed by Socket's Threat Research Team in July 2026. The campaign is attributed to North Korean threat actors operating within the broader Contagious Interview / Famous Chollima activity cluster (which also encompasses DeceptiveDevelopment, Operation Dream Job, and ClickFake Interview), and shares strong infrastructure and tooling overlaps with the previously tracked TasksJacker campaign, indicating repurposed state-sponsored infrastructure across multiple named operations.

The campaign began no later than December 2025/January 2026 (anti-dated malicious commits were inserted into 7span/sevenspan-maintained repositories as early as January 8, 2026) and has escalated steadily: 675 repositories across 352 owners were confirmed compromised at initial disclosure (March 8, 2026); by April 11-12, 2026 that grew nearly 3x to 1,951 repositories across 1,047 unique owners (~930 individuals, ~117 organizations); by July 2026 Socket confirmed cross-ecosystem expansion representing an overall 6.5x growth in confirmed footprint since the March baseline, with 162 malicious release artifacts identified across 108-111 unique packages and extensions spanning npm, Packagist (10 PHP packages under the sevenspan namespace), Go modules (80+ modules, 61 confirmed distinct malicious versions), and Chrome/browser extensions (1-2 identified).

The attackers use several parallel initial-access vectors. First, they compromise legitimate maintainer GitHub accounts (via account takeover, likely including expired-domain takeover of maintainer emails) and inject malicious commits directly into trusted repositories, frequently rewriting git history and force-pushing with anti-dated timestamps via a Windows batch script (temp_auto_push.bat / config.bat variant) to make the malicious changes appear to predate detection tooling and to bypass pre-commit hooks. Second, they distribute trojanized VS Code extensions and weaponized take-home coding-assessment repositories disguised as legitimate technical interview projects for job candidates (two identified templates: "ShoeVista", an e-commerce MERN-stack test targeting full-stack developers, and "StakingGame", a blockchain deployment test targeting Web3 developers, UUID e9b53a7c-2342-4b15-b02d-bd8b8f6a03f9). These projects embed `.vscode/tasks.json` configuration files with `"runOn": "folderOpen"` triggers that automatically execute Node.js/shell commands (curl | bash patterns) the moment the victim opens the project folder in VS Code, without requiring any further user interaction.

Once triggered, the initial loader — heavily obfuscated JavaScript appended after valid content in legitimate build/config files (postcss.config.js, vite.config.js, eslint.config.js, tailwind config files) — is padded with excessive whitespace to push the malicious code beyond the default editor screen width, hiding it from casual code review. The loader implements a custom "4-layer shuffle-cipher" decoder identified by variant markers `rmcej%otb%` (original variant) or `Cot%3t=shtP` (rotated variant), plus an additional loader signature `_$_1e42`. A second concealment technique embeds JavaScript payloads inside files disguised as WOFF2 web font binaries (fake .woff2 files) to evade static and signature-based security scanning.

The loader's second stage retrieves encrypted payload material from immutable, attacker-controlled transactions recorded on public blockchain/RPC infrastructure — TRON, Aptos, and BNB Smart Chain — functioning as a resilient, takedown-resistant dead-drop C2 channel. Retrieved payloads are decrypted using embedded XOR keys (`2[gWfGj;<:-93Z^C` and `m6:tTh^D)cBz?NM]`) and executed directly via JavaScript `eval()`. This blockchain dead-drop technique is functionally identical to JADESNOW-class loaders and overlaps with prior Lazarus Group / Contagious Interview tradecraft.

The decrypted stage-3 payload is the Beavertail JavaScript loader/stealer, which performs host and OS fingerprinting, browser and system reconnaissance, and exfiltration staging, then conditionally deploys OS-specific follow-on payloads. On Windows, macOS, and Linux targets this results in delivery of InvisibleFerret, a cross-platform backdoor providing keylogging, clipboard hijacking, persistent remote access, browser-stored credential theft, and cryptocurrency wallet file exfiltration, communicating over an attacker C2 channel. Socket's later reporting additionally documents delivery of DEV#POPPER (a remote-access trojan enabling arbitrary command execution) and OmniStealer (an information stealer using socket.io-client for its C2 channel, performing credential theft, browser-data theft, and cryptocurrency wallet exfiltration).

Additional observed C2 and staging infrastructure includes a cluster of Vercel-hosted subdomains used as configuration/bootstrap relays (260120.vercel.app, default-configuration.vercel.app, vscode-settings-bootstrap.vercel.app, vscode-settings-config.vercel.app, vscode-bootstrapper.vercel.app, vscode-load-config.vercel.app), plus onrender.com and the short.gy URL-shortening service used to obscure payload-delivery links.

Because GitHub repository write access and package-registry publishing access are frequently one and the same in the Go module and Packagist ecosystems, a single compromised maintainer GitHub account automatically republished malicious content to downstream package registries without requiring separate registry credentials — a key mechanism behind the campaign's rapid cross-ecosystem expansion in June-July 2026. A concentrated, synchronized modification of repositories maintained by GitHub account Xpos587 (including Xpos587/git2md, Xpos587/markfetch, and Artiffusion-Inc/mirofish) occurred within a narrow window beginning 10:00 UTC on June 23, 2026, coinciding with the spike in malicious Go module releases. Confirmed compromised npm packages include a cluster of fake Tailwind CSS utility packages (tailwindcss-style-animate, tailwind-mainanimation, tailwind-autoanimation, tailwindcss-typography-style, tailwindcss-animate-style, tailwindcss-style-modify) using postinstall hooks to trigger the loader at install time. Confirmed compromised Packagist packages (10, under the sevenspan/7span namespace and affiliated maintainers) include thiio/kubernetes-php-sdk, arsl/optima-class, olc/olc-php, sevenspan/laravel-whatsapp, adxio/twig-hmvc, sevenspan/code-generator, lambda-platform/moqup, roberts/leads, sevenspan/plusinfolab/logstation, and plusinfolab/logstation. Some 7span maintainers performed partial remediation on May 16, 2026 (removing fake font-file payloads), but the underlying injected loaders and Go/Packagist artifacts persisted and continued to expand afterward, with Socket confirming cross-ecosystem compromise as current as July 1, 2026 and the wider campaign still classified as actively expanding at the July 15, 2026 report date underlying this hunt.

No CVE has been assigned; this is a social-engineering-driven and account-takeover-driven supply-chain compromise rather than a software vulnerability, so exploitability is scored ACTIVE based on ongoing, confirmed real-world use rather than PoC public availability.