North Korean Hackers Publish 108 Malicious Packages and Extensions in Polin Rider Campaign
Summary: North Korean threat actors tied to the Contagious Interview campaign have published 162 malicious release artifacts across 108 unique packages and extensions, including 19 npm libraries, 10 Composer packages, 61 Go modules, and one Google Chrome extension, in an activity Socket calls PolinRider. As of April 11, 2026, the campaign has compromised 1,951 public GitHub repositories tied to 1,047 unique owners, planting obfuscated JavaScript loaders that fetch a second-stage payload from TRON, Aptos, and BNB Smart Chain services to deliver DEV#POPPER RAT and OmniStealer.
Key Takeaway: The attackers are not using stolen GitHub credentials; victims were compromised through a malicious VS Code extension or npm package, and Git history rewriting with force pushes and anti-dated commits makes the GitHub landing page and visible commit history unreliable indicators of compromise. With 1,047 owners already affected, any developer workstation that opened one of these repositories should be treated as compromised.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026