North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign

1. Executive summary

The Contagious Interview campaign (MITRE G1052) has expanded into a new supply-chain attack cluster dubbed PolinRider, publishing 108 unique malicious packages and browser extensions across npm, Packagist, Go, and Google Chrome, with 162 malicious release artifacts spanning multiple versions. The campaign has compromised 1,951 public GitHub repositories belonging to 1,047 unique owners, implanting obfuscated JavaScript loaders that deliver BeaverTail, DEV#POPPER RAT, and OmniStealer by contacting TRON, Aptos, and BNB Smart Chain blockchain infrastructure for second-stage payloads. Attribution to "North Korean threat actors" is unconfirmed — no MITRE ATT&CK profile exists for that actor designation; the Contagious Interview moniker itself is mapped to MITRE G1052. EMEA financial services with software development teams using npm, Composer, Go modules, or VS Code/Cursor IDEs face elevated risk of developer-workstation compromise leading to credential theft and downstream repository tampering.

2. Regulatory framing

3. Technical analysis & attack chain

Confirmed attack chain

1. Initial access via social engineering. Threat actors masquerade as recruiters or collaborators on LinkedIn, GitHub, or freelance websites, using elaborate front companies and AI-generated employee profiles to build trust with software developers, particularly in the cryptocurrency sector. Job interviews and assessments are used to trick victims into executing malicious code.
2. Supply-chain implant. Attackers plant obfuscated JavaScript loaders in legitimate GitHub repositories. Concealment techniques include whitespace padding and fake .woff2 font files. As of April 11, 2026, 1,951 public GitHub repositories associated with 1,047 unique owners have been compromised.
3. Package publication. 108 unique packages and extensions have been published across four ecosystems: - 19 npm libraries - 10 Composer packages (Packagist) - 61 Go modules - 1 Google Chrome extension - 162 malicious release artifacts total, spanning multiple release versions.
4. Execution trigger via developer tooling. The TaskJacker cluster drops malicious VS Code task files into existing GitHub repositories. VS Code tasks include the runOn: 'folderOpen' option, triggering arbitrary code execution when the folder is opened as a workspace in VS Code or Cursor IDE. Separately, malicious npm packages and VS Code extensions serve as execution vectors.
5. File infection. Once executed, the malware searches the infected computer for specific files: - postcss.config.mjs - tailwind.config.js - eslint.config.mjs - next.config.mjs - babel.config.js - app.js

If found, malicious JavaScript code is appended to these files.

6. Git history rewriting. A Windows batch script stealthily modifies the last commit, making it appear as if changes were made by the original author. Attackers use Git history rewriting including force pushes and anti-dated commits to make malicious changes appear older and less suspicious. Similar tools are suspected for Linux and macOS.
7. Second-stage payload delivery. The JavaScript malware loader contacts blockchain infrastructure — TRON, Aptos, and BNB Smart Chain services — to fetch an encrypted second-stage payload. This unpacks to: - DEV#POPPER RAT - OmniStealer

This attack chain was detailed by eSentire in March 2026.

8. Maintainer-account takeover. Attackers are believed to be taking over maintainer accounts, likely through expired-domain takeover or other account-recovery paths, to publish infected package versions while retaining registry access. OpenSourceMalware states: "The threat actor is not using stolen GitHub credentials. Instead, the victims have been compromised via a malicious VS Code extension or npm package."

Confidence caveats

• Attribution to "North Korean threat actors" is unconfirmed — no MITRE ATT&CK profile exists for that actor designation. The Contagious Interview campaign is mapped to MITRE G1052.
• The eSentire analysis of the DEV#POPPER RAT / OmniStealer delivery chain is single-sourced (eSentire, March 2026); verify before enforcement.
• The OpenSourceMalware reporting on 1,951 compromised repositories and 1,047 unique owners is single-sourced; corroborate with internal telemetry before treating as exhaustive.
• The expired-domain-takeover vector for maintainer-account compromise is described as suspected ("likely") by OpenSourceMalware, not confirmed.

4. Mitigation & containment

P1 — Within 24 hours

• Audit package manifests. Search all package.json, composer.json, go.mod, and Chrome extension manifests across development environments and CI/CD pipelines for any packages matching the 108 identified in the Socket report. Cross-reference against Socket's published package list.
• Block known malicious infrastructure. Add blockchain service endpoints associated with TRON, Aptos, and BNB Smart Chain to network blocklists on developer network segments where these services are not legitimately used.
• Isolate compromised workstations. Any developer workstation that has opened a repository containing VS Code task files with runOn: 'folderOpen' in the past 90 days should be isolated, scanned for the target filenames listed above, and examined for appended malicious JavaScript.
• Review Git commit history. The GitHub landing page and visible commit history are unreliable indicators of compromise. Review repository activity logs, audit logs, and force-push events rather than visible commit history.

P2 — Within 72 hours

• Scan for file infection. Search all developer workstations and shared repositories for the six target filenames (postcss.config.mjs, tailwind.config.js, eslint.config.mjs, next.config.mjs, babel.config.js, app.js) and inspect for unexpected appended JavaScript, particularly obfuscated blocks or whitespace-padded sections.
• Detect fake .woff2 files. Search repositories for .woff2 files that are not valid font files — these may conceal obfuscated JavaScript loaders. Validate file headers against expected WOFF2 magic bytes (wOF2).
• Audit VS Code task files. Search all repositories for .vscode/tasks.json files containing runOn: 'folderOpen' and review for unexpected command execution.
• Review maintainer-account access. Audit package-registry accounts (npm, Packagist, Go proxy) for password resets, email-address changes, or domain changes that could indicate expired-domain-takeover-based account recovery. Verify that maintainer email domains are still under legitimate control.
• Deploy dependency-scanning. Enable or enhance automated dependency scanning (e.g., Socket, Snyk, Dependabot) across all repositories to flag newly published packages with low reputation or suspicious metadata.

P3 — Within 7 days

• Pin critical dependencies. Pin all production dependencies to specific, reviewed versions using lockfiles (package-lock.json, composer.lock, go.sum). Implement CI/CD gates that fail builds on lockfile changes that introduce unreviewed package versions.
• Implement allowlisting. Establish package allowlists for development environments. Block installation of packages not on the allowlist, particularly for npm and Composer ecosystems.
• Restrict IDE extension installation. Enforce VS Code and Cursor extension allowlists via MDM or group policy. Block installation of unsigned or untrusted extensions.
• Developer awareness training. Brief all development staff on the Contagious Interview social-engineering pattern — fake recruiters on LinkedIn, GitHub, and freelance platforms; job interviews requiring code execution; assessment tasks involving running unfamiliar packages.
• Monitor for BeaverTail, DEV#POPPER, OmniStealer signatures. Ensure EDR/AV signatures are current for these named malware families. If vendor signatures are unavailable, deploy custom YARA/Sigma rules from §6 below.

5. Indicators of compromise

filename  postcss.config.mjs
filename  tailwind.config.js
filename  eslint.config.mjs
filename  next.config.mjs
filename  babel.config.js
filename  app.js
file_extension  .woff2
vscode_config  runOn: 'folderOpen'
malware_family  BeaverTail
malware_family  DEV#POPPER RAT
malware_family  OmniStealer
blockchain_service  TRON
blockchain_service  Aptos
blockchain_service  BNB Smart Chain
campaign_name  PolinRider
campaign_name  TaskJacker
campaign_name  Contagious Interview

6. Detection

YARA rule

rule PolinRider_JS_Loader_Indicators {
    meta:
        author = "Adverse Trace"
        date = "2026-07-04"
        reference = "https://thehackernews.com/2026/07/north-korean-hackers-publish-108.html"
        description = "Detects PolinRider/Contagious Interview obfuscated JS loader artefacts and fake woff2 concealment"
    strings:
        $file_postcss = "postcss.config.mjs" ascii
        $file_tailwind = "tailwind.config.js" ascii
        $file_eslint = "eslint.config.mjs" ascii
        $file_next = "next.config.mjs" ascii
        $file_babel = "babel.config.js" ascii
        $file_app = "app.js" ascii
        $woff2_magic = { 77 4F 46 32 }
        $runOn_folderOpen = "runOn: 'folderOpen'" ascii
        $beavertail = "BeaverTail" ascii nocase
        $devpopper = "DEV#POPPER" ascii nocase
        $omnistealer = "OmniStealer" ascii nocase
        $tron = "TRON" ascii
        $aptos = "Aptos" ascii
        $bnb = "BNB Smart Chain" ascii
    condition:
        3 of ($file_*) or
        ($runOn_folderOpen and 1 of ($file_*)) or
        2 of ($beavertail, $devpopper, $omnistealer) or
        2 of ($tron, $aptos, $bnb)
}

Sigma rule

title: PolinRider Malicious VS Code Task Execution
id: 6a7b8c9d-0e1f-4a2b-8c3d-4e5f6a7b8c9d
status: experimental
description: >
    Detects VS Code or Cursor IDE launching task files containing runOn: 'folderOpen',
    associated with the PolinRider/TaskJacker campaign. Also detects processes spawning
    from VS Code/Cursor that access known target files for malicious JavaScript injection.
author: Adverse Trace
date: 2026/07/04
references:

    - https://thehackernews.com/2026/07/north-korean-hackers-publish-108.html
logsource:
    product: windows
    category: process_creation
detection:
    selection_ide:
        ParentImage|endswith:

            - '\Code.exe'
            - '\cursor.exe'
    selection_task_trigger:
        CommandLine|contains:

            - "runOn: 'folderOpen'"
    selection_target_files:
        TargetFilename|endswith:

            - '\postcss.config.mjs'
            - '\tailwind.config.js'
            - '\eslint.config.mjs'
            - '\next.config.mjs'
            - '\babel.config.js'
            - '\app.js'
    condition: (selection_ide and selection_task_trigger) or (selection_ide and selection_target_files)
falsepositives:

    - Legitimate VS Code task configurations using runOn: folderOpen
    - Legitimate development activity accessing these common config files
level: high

Threat actor context

Contagious Interview · G1052 · aka DeceptiveDevelopment, Gwisin Gang, Tenacious Pungsan, DEV#POPPER, PurpleBravo

Contagious Interview is a North Korea–aligned threat group active since 2023. The group conducts both cyberespionage and financially motivated operations, including the theft of cryptocurrency and user credentials. Contagious Interview targets Windows, Linux, and macOS systems, with a particular focus on individuals engaged in software development and cryptocurrency-related activities.

No MITRE ATT&CK profile for: North Korean threat actors.

7. Sources

• The Hacker News, "North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign," https://thehackernews.com/2026/07/north-korean-hackers-publish-108.html, 2026-07-04
• Socket (Karlo Zanki), analysis referenced in The Hacker News article, 2026-07 (week of)
• OpenSourceMalware team, initial PolinRider identification, March 2026, referenced in The Hacker News
• eSentire, DEV#POPPER RAT / OmniStealer attack-chain analysis, March 2026, referenced in The Hacker News

8. Adverse Trace position

This is a high-severity supply-chain threat for EMEA financial services with active software development teams. The campaign is confirmed active, with new malicious packages continuing to appear. The combination of social-engineering-driven initial access (Contagious Interview, MITRE G1052), supply-chain implant across four major package ecosystems, Git-history manipulation to evade detection, and delivery of established RAT/stealer malware creates a credible path from developer-workstation compromise to credential exfiltration and downstream repository or CI/CD pipeline compromise. Attribution to "North Korean threat actors" is unconfirmed (no MITRE ATT&CK profile); the Contagious Interview campaign designation is corroborated (MITRE G1052). The eSentire-sourced payload-delivery chain (DEV#POPPER, OmniStealer) is single-sourced and should be verified before enforcement. We will continue monitoring Socket, OpenSourceMalware, and eSentire for the full 108-package list, new package publications, and additional IOCs including package names, repository URLs, and C2 infrastructure beyond the blockchain services identified. Clients should treat this as an active, evolving threat and implement the P1 mitigations immediately.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.