Worth reading · OpenSourceMalware
Earliest Known PolinRider Malware Found in 2025 npm Packages
Nine npm versions published in May 2025 after an account takeover carry the PolinRider payload, eight months before the first known victims.
Worth reading
Articles about PolinRider from other researchers and outlets, with a sentence on why each matters.
October 2026
Worth reading · OpenSourceMalware
GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font File
GhostAction copies PolinRider's hidden editor task and fake font file to run a stealer, with no shared indicators linking the two.
Worth reading · OpenSourceMalware
How to Investigate a GitHub Repo's Real History
How to rebuild a repository's true history after a force-push using push events and npm publish records, with a PolinRider case study.
September 2026
Worth reading · SafeDep
PolinRider Switches to Ethereum C2 in 30+ Repositories
SafeDep traces a PolinRider loader that now reads its C2 addresses from Ethereum transactions, found in 35 GitHub repositories.
Worth reading · OpenSourceMalware
PolinRider is A/B Testing its Way Past Your Detections
Renamed fake font files and moved tasks.json entries look like deliberate A/B tests against detection; lists the checks that still work.
Worth reading · Deception.Pro (MalBeacon)
[Op Report] Hands-on-Keyboard Activity from the DPRK "PolinRider" Supply Chain Attack
A decoy corporate network records a PolinRider operator deploying an infostealer and clipboard monitor by hand, with indicators and defences.
August 2026
Worth reading · OpenSourceMalware
NPM Isn't Prepared For North Korean PolinRider Attack
One compromised maintainer kept shipping infected npm releases after a takedown, showing why per-version takedowns cannot keep up.
Worth reading · OpenSourceMalware
A Developer's Guide to Getting Rid of PolinRider
An ordered clean-up guide for infected developers: contain the machine, clean GitHub repositories, then rotate credentials more widely.
July 2026
Worth reading · OpenSourceMalware
PolinRider Caused Dozens of npm, Go, PHP Compromises
Twenty npm and Go packages plus a PHP package were infected by automatic spread from developer machines, not targeted account takeovers.
Worth reading · OpenSourceMalware
ChainVeil and ViteVenom are DPRK’s PolinRider Campaign
Shared wallet addresses and XOR keys tie the ChainVeil and ViteVenom npm typosquats to PolinRider rather than separate actors.
Worth reading · OpenSourceMalware
PolinRider Confirmed Footprint Grows 6.5x Since March
A July hunt raises confirmed infections to about 4,367 repositories across 2,152 owners, with fake font files increasingly used.
Worth reading · SecurityOnline
North Korea-Linked PolinRider Supply Chain Attack Expands Across Open Source
News write-up of Socket's count of 162 malicious artifacts across npm, Packagist, Go and Chrome, with remediation advice.
Worth reading · OpenSourceMalware
PolinRider Jumps the Fence to Go, Packagist, npm, PyPI
Why PolinRider reached Go and Packagist straight from infected GitHub repositories while npm and PyPI needed separate publishing credentials.
Worth reading · SecurityWeek
North Korean Hackers Target Open Source Developers in Supply Chain Attacks
News report on PolinRider hijacking maintainer accounts across four ecosystems to deliver a RAT and an infostealer, citing Socket.
Worth reading · The Hacker News
North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign
News report on 108 malicious packages and extensions across npm, Packagist, Go and Chrome, delivering DEV#POPPER and OmniStealer.
April 2026
Worth reading · OpenSourceMalware
PolinRider DPRK Attack Expands Across GitHub
Infections triple to about 1,951 repositories across 1,047 owners, and the campaign merges with the TasksJacker cluster.
March 2026
Worth reading · OpenSourceMalware
TasksJacker DPRK Attack Compromises GitHub Users Via VS Code Tasks
Introduces TasksJacker, the auto-running tasks.json and history-rewriting phase, and argues it is the same operation as PolinRider.
Worth reading · OpenSourceMalware
Hundreds of GitHub Repos Compromised By DPRK's PolinRider Campaign
The first public report: obfuscated JavaScript appended to config files in hundreds of GitHub repositories, using blockchain-based C2.