# PolinRider DPRK Supply-Chain Campaign: Confirmed GitHub Footprint Grows 6.5x Since March (JADESNOW/Beavertail/InvisibleFerret Loaders, DEV#POPPER & OmniStealer Payloads)

> PolinRider, a DPRK-linked threat actor tied to the Contagious Interview / Famous Chollima cluster, has implanted obfuscated JavaScript loaders (tracked as JADESNOW, delivering Beavertail and InvisibleFerret) across public GitHub repositories, npm, Go modules, Packagist, and Chrome extensions. Confirmed footprint grew from 675 repositories (March 2026) to over 1,951 repositories and 108+ malicious packages (July 2026), a 6.5x increase, with payloads retrieved via blockchain dead-drops on TRON, Aptos, and BNB Smart Chain.

- **Published:** 2026-07-17T00:00:00Z
- **Last reviewed:** 2026-07-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1435
- **ID:** TL-2026-1435
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** PolinRider (North Korea)
- **Detections:** 9 · **IOCs:** 49 (full data via the Threadlinqs MCP server — Purple tier)

## Description

PolinRider is an active, expanding DPRK state-sponsored supply-chain compromise campaign first disclosed in March 2026 by the OpenSourceMalware (OSM) research team and further detailed by Socket's Threat Research Team in July 2026. The campaign is attributed to North Korean threat actors operating within the broader Contagious Interview / Famous Chollima activity cluster (which also encompasses DeceptiveDevelopment, Operation Dream Job, and ClickFake Interview), and shares strong infrastructure and tooling overlaps with the previously tracked TasksJacker campaign, indicating repurposed state-sponsored infrastructure across multiple named operations.

The campaign began no later than December 2025/January 2026 (anti-dated malicious commits were inserted into 7span/sevenspan-maintained repositories as early as January 8, 2026) and has escalated steadily: 675 repositories across 352 owners were confirmed compromised at initial disclosure (March 8, 2026); by April 11-12, 2026 that grew nearly 3x to 1,951 repositories across 1,047 unique owners (~930 individuals, ~117 organizations); by July 2026 Socket confirmed cross-ecosystem expansion representing an overall 6.5x growth in confirmed footprint since the March baseline, with 162 malicious release artifacts identified across 108-111 unique packages and extensions spanning npm, Packagist (10 PHP packages under the sevenspan namespace), Go modules (80+ modules, 61 confirmed distinct malicious versions), and Chrome/browser extensions (1-2 identified).

The attackers use several parallel initial-access vectors. First, they compromise legitimate maintainer GitHub accounts (via account takeover, likely including expired-domain takeover of maintainer emails) and inject malicious commits directly into trusted repositories, frequently rewriting git history and force-pushing with anti-dated timestamps via a Windows batch script (temp_auto_push.bat / config.bat variant) to make the malicious changes appear to predate detection tooling and to bypass pre-commit hooks. Second, they distribute trojanized VS Code extensions and weaponized take-home coding-assessment repositories disguised as legitimate technical interview projects for job candidates (two identified templates: "ShoeVista", an e-commerce MERN-stack test targeting full-stack developers, and "StakingGame", a blockchain deployment test targeting Web3 developers, UUID e9b53a7c-2342-4b15-b02d-bd8b8f6a03f9). These projects embed `.vscode/tasks.json` configuration files with `"runOn": "folderOpen"` triggers that automatically execute Node.js/shell commands (curl | bash patterns) the moment the victim opens the project folder in VS Code, without requiring any further user interaction.

Once triggered, the initial loader — heavily obfuscated JavaScript appended after valid content in legitimate build/config files (postcss.config.js, vite.config.js, eslint.config.js, tailwind config files) — is padded with excessive whitespace to push the malicious code beyond the default editor screen width, hiding it from casual code review. The loader implements a custom "4-layer shuffle-cipher" decoder identified by variant markers `rmcej%otb%` (original variant) or `Cot%3t=shtP` (rotated variant), plus an additional loader signature `_$_1e42`. A second concealment technique embeds JavaScript payloads inside files disguised as WOFF2 web font binaries (fake .woff2 files) to evade static and signature-based security scanning.

The loader's second stage retrieves encrypted payload material from immutable, attacker-controlled transactions recorded on public blockchain/RPC infrastructure — TRON, Aptos, and BNB Smart Chain — functioning as a resilient, takedown-resistant dead-drop C2 channel. Retrieved payloads are decrypted using embedded XOR keys (`2[gWfGj;<:-93Z^C` and `m6:tTh^D)cBz?NM]`) and executed directly via JavaScript `eval()`. This blockchain dead-drop technique is functionally identical to JADESNOW-class loaders and overlaps with prior Lazarus Group / Contagious Interview tradecraft.

The decrypted stage-3 payload is the Beavertail JavaScript loader/stealer, which performs host and OS fingerprinting, browser and system reconnaissance, and exfiltration staging, then conditionally deploys OS-specific follow-on payloads. On Windows, macOS, and Linux targets this results in delivery of InvisibleFerret, a cross-platform backdoor providing keylogging, clipboard hijacking, persistent remote access, browser-stored credential theft, and cryptocurrency wallet file exfiltration, communicating over an attacker C2 channel. Socket's later reporting additionally documents delivery of DEV#POPPER (a remote-access trojan enabling arbitrary command execution) and OmniStealer (an information stealer using socket.io-client for its C2 channel, performing credential theft, browser-data theft, and cryptocurrency wallet exfiltration).

Additional observed C2 and staging infrastructure includes a cluster of Vercel-hosted subdomains used as configuration/bootstrap relays (260120.vercel.app, default-configuration.vercel.app, vscode-settings-bootstrap.vercel.app, vscode-settings-config.vercel.app, vscode-bootstrapper.vercel.app, vscode-load-config.vercel.app), plus onrender.com and the short.gy URL-shortening service used to obscure payload-delivery links.

Because GitHub repository write access and package-registry publishing access are frequently one and the same in the Go module and Packagist ecosystems, a single compromised maintainer GitHub account automatically republished malicious content to downstream package registries without requiring separate registry credentials — a key mechanism behind the campaign's rapid cross-ecosystem expansion in June-July 2026. A concentrated, synchronized modification of repositories maintained by GitHub account Xpos587 (including Xpos587/git2md, Xpos587/markfetch, and Artiffusion-Inc/mirofish) occurred within a narrow window beginning 10:00 UTC on June 23, 2026, coinciding with the spike in malicious Go module releases. Confirmed compromised npm packages include a cluster of fake Tailwind CSS utility packages (tailwindcss-style-animate, tailwind-mainanimation, tailwind-autoanimation, tailwindcss-typography-style, tailwindcss-animate-style, tailwindcss-style-modify) using postinstall hooks to trigger the loader at install time. Confirmed compromised Packagist packages (10, under the sevenspan/7span namespace and affiliated maintainers) include thiio/kubernetes-php-sdk, arsl/optima-class, olc/olc-php, sevenspan/laravel-whatsapp, adxio/twig-hmvc, sevenspan/code-generator, lambda-platform/moqup, roberts/leads, sevenspan/plusinfolab/logstation, and plusinfolab/logstation. Some 7span maintainers performed partial remediation on May 16, 2026 (removing fake font-file payloads), but the underlying injected loaders and Go/Packagist artifacts persisted and continued to expand afterward, with Socket confirming cross-ecosystem compromise as current as July 1, 2026 and the wider campaign still classified as actively expanding at the July 15, 2026 report date underlying this hunt.

No CVE has been assigned; this is a social-engineering-driven and account-takeover-driven supply-chain compromise rather than a software vulnerability, so exploitability is scored ACTIVE based on ongoing, confirmed real-world use rather than PoC public availability.

## MITRE ATT&CK

- T1593 Search Open Websites/Domains
- T1585 Establish Accounts
- T1586 Compromise Accounts
- T1587 Develop Capabilities
- T1584 Compromise Infrastructure
- T1583 Acquire Infrastructure
- T1195 Supply Chain Compromise
- T1566 Phishing
- T1199 Trusted Relationship
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1053 Scheduled Task/Job
- T1098 Account Manipulation
- T1505 Server Software Component
- T1554 Compromise Host Software Binary
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1070 Indicator Removal
- T1140 Deobfuscate/Decode Files or Information
- T1564 Hide Artifacts
- T1555 Credentials from Password Stores
- T1056 Input Capture
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1005 Data from Local System
- T1115 Clipboard Data
- T1071 Application Layer Protocol
- T1102 Web Service
- T1573 Encrypted Channel
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft

## Sources

- [PolinRider Confirmed Footprint Grows 6.5x Since March](https://malpedia.caad.fkie.fraunhofer.de/library/fb0dc806-33b7-4c01-aef2-032cda1b8617/)
- [PolinRider: North Korea-Linked Supply Chain Campaign Expands Across Open Source Ecosystems](https://socket.dev/blog/polinrider-north-korea-linked-supply-chain-campaign-expands)
- [PolinRider Campaign: DPRK-Linked Supply Chain Attack Infects GitHub Repositories](https://threats.wiz.io/all-incidents/polinrider-campaign-dprk-linked-supply-chain-attack-infects-github-repositories)
- [PolinRider DPRK Attack Expands Across GitHub](https://opensourcemalware.com/blog/polinrider-rides-again-north-korean-attack-expands-across-github)
- [PolinRider: A detailed technical dossier on the DPRK threat actor](https://github.com/OpenSourceMalware/PolinRider)
- [North Korean Hackers Target Open Source Developers in Supply Chain Attacks](https://www.securityweek.com/north-korean-hackers-target-open-source-developers-in-supply-chain-attacks/)
- [PolinRider Jumps the Fence to Go, Packagist, npm, PyPI](https://opensourcemalware.com/blog/polinrider-jumps-the-fence)
- [PolinRider supply chain attack - Cloud Threat Landscape](https://threats.wiz.io/all-incidents/polinrider-supply-chain-attack)
- [PolinRider DPRK Supply-Chain Campaign - Malicious npm and VS Code Artifacts Infect 1,900+ GitHub Repositories](https://anomity.ai/blog/polinrider-dprk-github-supply-chain-campaign/)
- [PolinRider Campaign (mirror)](https://imtr.net/article/polinrider-campaign-dprk-linked-supply-chain-attack-infects-github-repositories-9d29)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1435