Socket proactively blocks malicious open source packages in your code.
Socket Threat Research Team identified 162 malicious release artifacts across 108 packages and extensions in npm, Packagist, Go modules, and Chrome extensions, linking the activity to the broader North Korean Contagious Interview / Famous Chollima developer-targeting campaign.
PolinRider is a supply chain campaign linked to North Korean threat actors associated with the broader Contagious Interview / Famous Chollima activity cluster. Our latest findings show that the campaign has expanded beyond npm into additional open source ecosystems, with 162 malicious release artifacts identified across 108 unique packages, including compromise traces in 80 Go modules, 10 Packagist packages, and one Chrome extension. The campaign remains active, and new malicious packages are likely to continue appearing as threat actors compromise maintainer accounts, modify legitimate repositories, and publish infected package versions where they retain or obtain registry access.
The core tradecraft remains consistent across the campaign: threat actors plant obfuscated JavaScript loaders in legitimate repositories, conceal the code through whitespace padding or fake .woff2 font files, and trigger execution through developer tooling such as VS Code task files. The threat actors use Git history rewriting, including force pushes and anti-dated commits to make malicious changes appear older and less suspicious. This makes the GitHub landing page and visible commit history unreliable indicators of compromise; defenders should review repository activity logs, package release metadata, VS Code task configuration, and suspicious changes to configuration files.
Once deobfuscated, the payload functions as a JavaScript malware loader that reaches out to blockchain and public RPC infrastructure, including TRON, Aptos, and BNB Smart Chain services, retrieves encrypted second-stage payload material, decrypts it with embedded XOR keys, and executes the result with eval(). Current observed payloads include DEV#POPPER and OmniStealer, but the loader-based design means the campaign should be treated as capable of delivering additional malware. Teams that installed affected package versions should treat the environment as compromised, preserve forensic artifacts, rebuild from known-good lockfiles, rotate exposed secrets from a clean machine, and audit developer workstations and repositories for hidden execution paths.
PolinRider is ongoing, and Socket continues to identify fresh compromises, malicious package versions, and extensions tied to this campaign. Because the threat actors repeatedly compromise legitimate repositories and expand across ecosystems, additional affected artifacts are likely to surface. Socket is tracking the campaign on a live page, where affected packages, versions, and updates are added as they are confirmed: https://socket.dev/supply-chain-attacks/polinrider
PolinRider’s typical operating pattern involves compromising legitimate GitHub repositories and planting malicious commits containing obfuscated JavaScript loaders. In many cases, the malicious code is inserted as a one-line payload and hidden from immediate view by padding the line with whitespace, pushing the executable code beyond the default screen width.
In some observed cases, the activity is consistent with GitHub maintainer-account takeover, potentially through expired domain takeover or another account recovery path. Once the threat actors control a maintainer account, they can modify multiple repositories and, where registry access is available, publish malicious package versions to downstream ecosystems.
One recent example is the Xpos587 GitHub account. Several repositories maintained by this account were modified in the same narrow time window on June 23 at 10:00 UTC. This synchronized update pattern is unlikely to reflect normal maintainer activity and is consistent with account-level compromise followed by bulk repository modification.
The Xpos587 repository list shows multiple unrelated projects updated in the same period, with aligned activity spikes across repositories. This pattern indicates coordinated account-level modification rather than ordinary per-project maintenance.
Commit history alone may not reveal the compromise. In some affected repositories, the visible GitHub file view and latest commit metadata appear benign, with changes dated months earlier and commit messages that resemble routine maintenance. This makes the repository appear trustworthy unless reviewers inspect additional GitHub activity signals.
The Xpos587/markfetch repository appears normal in the standard GitHub file view, with routine-looking commit messages and file timestamps dating back months. This view can obscure later evidence of malicious changes when repository history has been rewritten.
Evidence of Git history rewriting appears in the repository’s GitHub Activity tab. In this case, the Activity view shows a recent force push that modified prior commit history. As a result, the main repository page gives the impression that nothing changed recently, while the Activity tab reveals that older-looking commits were altered after the fact to insert malicious payloads.
GitHub Activity exposes the force push used to rewrite repository history. While the main file view suggests the repository had not changed for months, the Activity tab shows recent modification of older commits, consistent with backfilled malicious payload insertion.
When threat actors gain both repository access and the ability to publish to a package registry, the compromise can extend beyond GitHub into downstream package ecosystems. In the Xpos587 case, malicious versions of affected Go modules were published after repositories under the account were modified.
Socket flags a malicious Xpos587/git2md Go module release under the Xpos587 account, showing how repository compromise can propagate into published package artifacts when registry access is available.
We did not observe malicious releases from this maintainer’s PyPI account. This may indicate that the threat actors did not obtain the required PyPI publishing credentials, were blocked by PyPI security controls, or otherwise lacked the access needed to publish malicious Python package versions.
Recent PolinRider activity shows the campaign expanding into Packagist, with several compromised packages identified under the sevenspan namespace, which is maintained by the 7span organization. Repository maintainers identified part of the compromise and removed fake .woff2 font files from affected GitHub repositories and packages.
The 7span commit timeline shows anti-dated January 8 commits associated with malicious payload insertion, followed by a May 16 commit removing PolinRider from one affected repository.
The cleanup did not remove all PolinRider payload variants. While the fake-font payloads were detected and removed, obfuscated JavaScript hidden in configuration files remained present in some affected repositories. This shows that remediation focused only on one payload-hiding method can miss other variants used by the same campaign.
The GitHub diff shows obfuscated JavaScript appended inside vite.config.js alongside normal configuration code. Because Git history was rewritten, the malicious code appears to be part of an older legitimate commit rather than a recent compromise.
We did not observe corresponding malicious npm releases from the same organization in this case. This suggests the threat actors may not have obtained the npm publishing secrets or registry access needed to push malicious versions to npm, even though related GitHub repositories were modified.
Across observed PolinRider variants, the malicious code typically functions as an obfuscated JavaScript loader after deobfuscation. In some cases, the loader reaches out to blockchain and public RPC infrastructure, including TRON, Aptos, and BNB Smart Chain services, retrieves encrypted second-stage payload material, decrypts it with embedded XOR keys, and executes the result with eval(). Observed follow-on payloads include DEV#POPPER and OmniStealer, which provide capabilities such as command execution, socket.io-client-based C2 communication, credential theft, browser-data theft, and wallet exfiltration. However, the loader-based design should be treated as capable of delivering additional malware as the campaign evolves.
The Socket Threat Research Team has identified two primary payload-hiding methods associated with PolinRider. Earlier activity commonly hid obfuscated JavaScript inside configuration files, including *config.js files. More recent variants hide the loader inside fake .woff2 font files and trigger execution through VS Code task files.
The .vscode/tasks.json file defines a hidden task that runs on folder open and executes a fake .woff2 font file with Node.js. This turns a file that appears to be a static font asset into an execution path for the obfuscated JavaScript loader.
Both methods appear across compromised repositories linked to the previously discussed Xpos587 GitHub account. The Xpos587/markfetch repository used the fake-font variant, while the Artiffusion-Inc/mirofish repository contained a payload hidden in vite.config.js, inserted by the same Xpos587 user. The reason the threat actors choose one hiding method over another in specific repositories remains unclear.
Teams that installed any affected package or extension version should treat the installing environment as potentially compromised until reviewed. Because PolinRider targets developer environments and may expose package registry, source code, cloud, and CI/CD credentials, remediation should be performed from a clean machine, not from the potentially infected host.
Recommended response:
"runOn": "folderOpen" run option configured. Search for commands that execute files with untypical extensions - like commands executing _.woff2 files with node..vscode/tasks.json, config.js, vite.config.js, eslint.config.js, or files under font/static asset directories.Xpos587 — GitHub accountXpos587/git2mdXpos587/markfetchArtiffusion-Inc/mirofishsevenspan — Packagist namespace7span — GitHub organization7span/react-listLoading affected packages…
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。