PolinRider Scanner

    Download

    What is PolinRider malware?

    PolinRider is malware that hides inside software projects. Once it runs on a developer's computer, it steals their passwords and tokens, adds itself to the code they work on and pushes that code with their own account, so the next person who opens the project is hit too.

    Its goal is not your code. The code is how it travels. The goal is your logins and your money.

    How it gets in

    • A packageFrom npm, Go or Composer. It runs when the package is installed, or when your build loads it.
    • An editor extensionFor VS Code or Cursor. It runs as soon as the editor loads the extension.
    • A project you openA cloned repository or a job-interview test. A hidden editor task runs a command the moment the folder opens.

    Opening the folder is enough. You do not have to run the project, install anything or click anything (OpenSourceMalware; fake fonts).

    Am I at risk?

    You could be if you write code and, in the last year or so, you did any of these:

    • installed an npm, Go or Composer package;
    • installed a VS Code or Cursor extension;
    • opened someone else's project in your editor, including one you cloned to review;
    • did a "take-home" coding test for a job interview.

    None of these is unusual, which is the point. A check takes a few minutes: install and run polinrider.

    What it does on your computer

    First a small piece of hidden JavaScript runs. It fetches the real malware from records stored on public blockchains, which means there is no single website to block or take down (OpenSourceMalware; SafeDep).

    That second part is built to steal. Reports name the DEV#POPPER remote access tool and the OmniStealer password stealer (The Hacker News).

    Then it spreads. It adds itself to the projects on your computer and pushes them to GitHub with your account. In one case researchers watched an operator at the keyboard, installing a stealer and a clipboard monitor by hand (Deception.Pro).

    What it goes after

    • Passwords and logged-in sessions saved in your browser
    • GitHub tokens and SSH keys, and the login of the gh command
    • npm, cloud, database and CI tokens
    • Every secret in every .env file it can read
    • Cryptocurrency wallets and their recovery phrases

    How it spreads to other people

    1. 1Your computer runs itYou install a package or an extension, or simply open an infected project in your editor.
    2. 2It steals and hidesIt takes your passwords and tokens, and adds itself to the code you work on.
    3. 3It pushes with your accountIt rewrites your last commit, keeps your name and the old date, and force-pushes it.
    4. 4The next person opens itAnyone who opens or installs that project is hit too, and it starts again.

    And around again, from every new computer it reaches.

    Why your Git history looks clean

    This is why people miss it. A small script on the infected computer, temp_auto_push.bat, rewrites your last commit and pushes it again (OpenSourceMalware):

    1. 1It reads your last commit: its date, message and author.
    2. 2It winds the computer's clock back to that commit's date.
    3. 3It adds the malware to that commit, keeping your name and message.
    4. 4It puts the clock right and force-pushes the branch.

    So the commit looks exactly as it did before. Your name, your message, the original date. Reading git log will not show you anything wrong. What it cannot change is GitHub's own record of the push. GitHub writes down every push and force-push with the account that made it and the real time, and none of that comes from the commit (How to investigate a repo's real history).

    Looks fine

    What git log shows you

    a41c9e2  Fix navbar spacing
         You · 12 Oct, 10:42

    Looks normal: your name, your message, the old date.

    What happened

    What GitHub's push record shows

    force-pushed main
from 7d03b18 to a41c9e2
by your account · 3 Nov, 02:13

    The real push: when it happened and that it replaced a commit.

    An example, with made-up commit IDs and times.

    That record is how polinrider finds the clean version to go back to. GitHub keeps it for a limited time, so check early. Once the record is gone, the infected commit can only be cleaned, not undone.

    Signs you might be infected

    Each of these is something you can see in a project or on your computer.

    • A font file that is really code

      A file such as public/fonts/fa-solid-400.woff2 that holds JavaScript instead of a font. A real .woff2 font starts with the letters wOF2. The names keep changing.

      Read more: fake font files

    • An editor task that runs when you open the folder

      A .vscode/tasks.json with "runOn": "folderOpen", often labelled like a normal tool such as eslint-check, with its output hidden.

    • Code after the end of a config file

      In postcss.config.mjs, tailwind.config.js, eslint.config.mjs and similar, extra code after the real end of the file, often pushed far to the right by a long run of spaces.

    • temp_auto_push.bat

      In a project or listed in a .gitignore nobody on your team wrote. It means a computer that pushes to that project is infected.

      Read more: temp_auto_push.bat

    • It keeps coming back

      Your antivirus removes it and it is back the next time you run npm run dev. Something that starts it has not been found yet.

      Read more: when it keeps coming back

    • MicrosoftSystem64

      Running on your computer, or folders named .pcl-data and .pcl-state in your home folder. That is related malware, below.

      Read more: MicrosoftSystem64

    MicrosoftSystem64 is a remote-access tool installed by malicious npm packages. It is related to PolinRider through the group behind it, not part of PolinRider itself. SafeDep places the packages that install it in a cluster that kmsec.uk and OX Security link to Famous Chollima, also called Contagious Interview, a group tied to North Korea (SafeDep). No report we have read calls MicrosoftSystem64 a PolinRider payload.

    polinrider checks for it too, because it targets the same developers and needs the same response: a program or process named MicrosoftSystem64, and the folders ~/.pcl-data and ~/.pcl-state. MicrosoftSystem64 on your computer has the detail.

    Who is behind it

    Security researchers link PolinRider to North Korea (OpenSourceMalware; The Hacker News). OpenSourceMalware considers it a parallel or sub-campaign of Contagious Interview (OpenSourceMalware).

    Key facts

    Timeline

    1. May 2025The earliest known PolinRider code, found later in nine npm versions published after an account takeover. OpenSourceMalware, 30 October 2026 (opens in a new tab)
    2. 8 March 2026First public report: hidden JavaScript added to config files in hundreds of GitHub repositories. OpenSourceMalware (opens in a new tab)
    3. 31 March 2026The editor task that runs on folder open, and the history rewriting, described as part of the same operation. OpenSourceMalware (opens in a new tab)
    4. 12 April 2026About 1,951 infected repositories across 1,047 owners. Fake font files become part of the kit. OpenSourceMalware (opens in a new tab)
    5. 4 July 2026108 malicious packages and extensions across npm, Packagist, Go and Chrome. The Hacker News (opens in a new tab)
    6. 15 July 2026About 4,367 infected repositories across 2,152 owners. OpenSourceMalware (opens in a new tab)
    7. 9 September 2026An operator seen working by hand on a decoy network, installing a stealer and a clipboard monitor. Deception.Pro (opens in a new tab)
    8. 26 September 2026Fake font files renamed and moved, to get past detection. OpenSourceMalware (opens in a new tab)
    9. 30 September 2026A loader that reads its server addresses from Ethereum, found in 35 GitHub repositories. SafeDep (opens in a new tab)

    Sources

    1. OpenSourceMalware, Hundreds of GitHub Repos Compromised By DPRK's PolinRider Campaign, 8 March 2026
    2. OpenSourceMalware, PolinRider Confirmed Footprint Grows 6.5x Since March, 15 July 2026
    3. OpenSourceMalware, PolinRider is A/B Testing its Way Past Your Detections, 26 September 2026
    4. OpenSourceMalware, How to Investigate a GitHub Repo's Real History, 6 October 2026
    5. The Hacker News, North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign, 4 July 2026
    6. SafeDep, PolinRider Switches to Ethereum C2 in 30+ Repositories, 30 September 2026
    7. SafeDep, Inside MicrosoftSystem64: A Supply Chain RAT Exfiltrating to HuggingFace, 28 May 2026
    8. Deception.Pro, Hands-on-Keyboard Activity from the DPRK "PolinRider" Supply Chain Attack, 9 September 2026

    Check if you're affected

    Check your computer, your GitHub account or your organisation. It takes a few minutes and changes nothing until you type yes.

    The developer's guide to getting rid of PolinRider · The full indicator set

    Check now

    Last updated:

    Edit this page on GitHub