PolinRider Scanner

    Download

    PolinRider updates

    What's happening with PolinRider.

    RSS

    Where things stand

    Reports on PolinRider are still coming in. Since September researchers have seen its fake font file change its name again, found it starting at logon on Windows under the name MicrosoftCLROptimization and traced its earliest known code to npm packages published in May 2025. If you install npm packages or open other people’s projects in VS Code, check your computer first and your GitHub account second.

    Updated · Sources: OpenSourceMalware (26 September and 30 October), Deception.Pro (9 September), the BleepingComputer forum thread (30 October)

    November 2026

    1. Guide

      How to get rid of PolinRider: a developer's guide

      Think PolinRider is on your computer or in your repositories? How to check with polinrider, clean up in the right order and keep it from coming back.

      10 min read

    2. Announcement

      PolinRider Scanner 3.0: polinrider-cleaner has a new name and a new home

      The project is now polinrider-scanner, at polinriderscanner.com. The program is the same; the package names and how you verify old releases change.

      4 min read

    3. Analysis

      MicrosoftSystem64: what it is and how to remove it

      MicrosoftSystem64 is not part of Windows. It is a remote-access trojan that malicious npm packages install, now found inside working GitHub projects too.

      4 min read

    4. Guide

      Is it PolinRider or a false alarm? Reading a scan result

      polinrider 2.3.0 reads more of your files, so a project it once called clean can now show review lines. What each answer means and which matches are harmless.

      4 min read

    5. Indicator review15 indicators added this week

    October 2026

    1. Guide

      Why PolinRider keeps coming back after you remove it

      A developer's antivirus kept removing PolinRider and it kept returning. Their logs pointed to a logon entry. Where else it comes back from, and what stops it.

      4 min read

    2. Worth reading · OpenSourceMalware

      Earliest Known PolinRider Malware Found in 2025 npm Packages

      Nine npm versions published in May 2025 after an account takeover carry the PolinRider payload, eight months before the first known victims.

    3. Indicator review9 indicators added this week
    4. Indicator reviewNo change this week

    5. Analysis

      PolinRider's fake woff2 font that is really JavaScript

      PolinRider hides its loader in files named like Font Awesome fonts, and it has gone by four names this year. The first four bytes give it away.

      4 min read

    6. Indicator review2 indicators added this week
    7. Indicator review12 indicators added this week

    8. Analysis

      Found temp_auto_push.bat in your repository?

      temp_auto_push.bat is the script PolinRider uses to rewrite your commits and push them. What it does, why git log hides it and which computer to check first.

      4 min read

    9. Worth reading · OpenSourceMalware

      GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font File

      GhostAction copies PolinRider's hidden editor task and fake font file to run a stealer, with no shared indicators linking the two.

    10. Indicator review12 indicators added this week

    11. Worth reading · OpenSourceMalware

      How to Investigate a GitHub Repo's Real History

      How to rebuild a repository's true history after a force-push using push events and npm publish records, with a PolinRider case study.

    12. Indicator review83 indicators added this week

    September 2026

    1. Worth reading · SafeDep

      PolinRider Switches to Ethereum C2 in 30+ Repositories

      SafeDep traces a PolinRider loader that now reads its C2 addresses from Ethereum transactions, found in 35 GitHub repositories.

    2. Indicator review11 indicators added this week

    3. Worth reading · OpenSourceMalware

      PolinRider is A/B Testing its Way Past Your Detections

      Renamed fake font files and moved tasks.json entries look like deliberate A/B tests against detection; lists the checks that still work.

    4. Indicator review8 indicators added this week
    5. Indicator review19 indicators added this week

    6. Worth reading · Deception.Pro (MalBeacon)

      [Op Report] Hands-on-Keyboard Activity from the DPRK "PolinRider" Supply Chain Attack

      A decoy corporate network records a PolinRider operator deploying an infostealer and clipboard monitor by hand, with indicators and defences.

    7. Indicator review3 indicators added this week

    August 2026

    1. Worth reading · OpenSourceMalware

      NPM Isn't Prepared For North Korean PolinRider Attack

      One compromised maintainer kept shipping infected npm releases after a takedown, showing why per-version takedowns cannot keep up.

    2. Worth reading · OpenSourceMalware

      A Developer's Guide to Getting Rid of PolinRider

      An ordered clean-up guide for infected developers: contain the machine, clean GitHub repositories, then rotate credentials more widely.

    July 2026

    1. Worth reading · OpenSourceMalware

      PolinRider Caused Dozens of npm, Go, PHP Compromises

      Twenty npm and Go packages plus a PHP package were infected by automatic spread from developer machines, not targeted account takeovers.

    2. Worth reading · OpenSourceMalware

      ChainVeil and ViteVenom are DPRK’s PolinRider Campaign

      Shared wallet addresses and XOR keys tie the ChainVeil and ViteVenom npm typosquats to PolinRider rather than separate actors.

    3. Worth reading · OpenSourceMalware

      PolinRider Confirmed Footprint Grows 6.5x Since March

      A July hunt raises confirmed infections to about 4,367 repositories across 2,152 owners, with fake font files increasingly used.

    4. Worth reading · SecurityOnline

      North Korea-Linked PolinRider Supply Chain Attack Expands Across Open Source

      News write-up of Socket's count of 162 malicious artifacts across npm, Packagist, Go and Chrome, with remediation advice.

    5. Worth reading · OpenSourceMalware

      PolinRider Jumps the Fence to Go, Packagist, npm, PyPI

      Why PolinRider reached Go and Packagist straight from infected GitHub repositories while npm and PyPI needed separate publishing credentials.

    6. Worth reading · SecurityWeek

      North Korean Hackers Target Open Source Developers in Supply Chain Attacks

      News report on PolinRider hijacking maintainer accounts across four ecosystems to deliver a RAT and an infostealer, citing Socket.

    7. Worth reading · The Hacker News

      North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign

      News report on 108 malicious packages and extensions across npm, Packagist, Go and Chrome, delivering DEV#POPPER and OmniStealer.

    April 2026

    1. Worth reading · OpenSourceMalware

      PolinRider DPRK Attack Expands Across GitHub

      Infections triple to about 1,951 repositories across 1,047 owners, and the campaign merges with the TasksJacker cluster.

    March 2026

    1. Worth reading · OpenSourceMalware

      TasksJacker DPRK Attack Compromises GitHub Users Via VS Code Tasks

      Introduces TasksJacker, the auto-running tasks.json and history-rewriting phase, and argues it is the same operation as PolinRider.

    2. Worth reading · OpenSourceMalware

      Hundreds of GitHub Repos Compromised By DPRK's PolinRider Campaign

      The first public report: obfuscated JavaScript appended to config files in hundreds of GitHub repositories, using blockchain-based C2.