- North Korean-linked threat actors, known as Contagious Interview, have expanded their PolinRider supply-chain campaign to 108 malicious packages and browser extensions.
- The campaign actively compromises developer accounts and modifies public GitHub repositories, using sophisticated techniques like Git history rewriting to conceal malicious code.
- Infected systems are deployed to target cryptocurrency sectors, ultimately delivering information-stealing malware like DEV#POPPER RAT and OmniStealer.
- Security researchers recommend users treat any environment with these packages as fully compromised and rotate all exposed credentials immediately.
A North Korean-aligned hacking group has significantly expanded a persistent software supply-chain attack, deploying 162 malicious release artifacts across popular developer platforms. Security firm Socket reported this ongoing activity, dubbed PolinRider, now includes 19 npm libraries, 10 Composer packages, 61 Go modules, and a Chrome extension. Consequently, the campaign has compromised nearly 2,000 public GitHub repositories, according to OpenSourceMalware data.
The threat actors masquerade as recruiters on platforms like LinkedIn, using elaborate front companies to target cryptocurrency professionals. Their method, known as Contagious Interview, tricks developers into executing malicious code through fake job interviews. However, they have now shifted to directly compromising developer accounts and repositories.
Once a system is infected, the malware modifies key project configuration files to append malicious JavaScript code. It also uses stealthy scripts to rewrite Git commit history, making changes appear old and legitimate. “The core tradecraft remains consistent across the campaign: threat actors plant obfuscated JavaScript loaders in legitimate repositories, conceal the code through whitespace padding or fake .woff2 font files, and trigger execution through developer tooling such as VS Code task files,” Socket said.
The final payload acts as a loader that fetches encrypted malware from blockchain networks. This second-stage payload unpacks to information-stealers like DEV#POPPER RAT and OmniStealer. Users who have installed these packages should therefore treat their environment as fully compromised. Security experts advise rotating all exposed secrets from a clean machine and auditing repositories for suspicious changes.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
