North Korean Hackers Target Open-Source Developers in PolinRider Campaign
Summary
Socket reports that the PolinRider campaign has targeted open-source developers since December 2025, compromising repositories and packages to deliver DEV#POPPER and OmniStealer. It identified 162 malicious release artifacts across 108 packages.
Key points
- Socket reports that PolinRider has targeted developers across NPM, Packagist, Go modules, and Chrome extensions since December 2025.
- Socket identified 162 malicious release artifacts across 108 unique packages, with more potentially emerging.
- The attackers reportedly compromise maintainer accounts and rewrite Git history to make malicious changes appear older.
- Obfuscated JavaScript loaders retrieve encrypted payloads through blockchain and public RPC infrastructure; the payloads include the DEV#POPPER RAT and OmniStealer.
- The campaign is associated with the broader Contagious Interview operation, whose tactics have also appeared in DeceptiveDevelopment, Operation Dream Job, and ClickFake Interview.
- Socket says multiple packages in the Packagist sevenspan namespace were compromised, with loaders hidden in configuration files that cleanup did not identify.
- Socket advises users of affected versions to review potentially compromised environments and perform remediation from a clean machine, as developer, registry, source-code, cloud, and CI/CD credentials may be exposed.
Article Details
- Event Type
- Software supply-chain campaign targeting open-source developers
- Impact
- Socket identified 162 malicious release artifacts across 108 unique packages. The compromised packages and extensions may compromise developer environments and expose package registry, source code, cloud, and CI/CD credentials.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe compromised repositories contained obfuscated JavaScript loaders.T1078 · Valid AccountsThe attackers compromised maintainer accounts to modify repositories and publish infected packages.T1105 · Ingress Tool TransferThe loaders retrieved encrypted payloads from blockchain and public RPC infrastructure.T1195.001 · Compromise Software Dependencies and Development ToolsAttackers tampered with repositories and pushed infected packages, compromising software dependencies.
Malware
DEV#POPPERDecember 2025, using compromised GitHub repositories injected with JavaScript loaders leading to the DEV#POPPER remote access trojan (RAT) and the OmniStealer information stealer.OmniStealerinjected with JavaScript loaders leading to the DEV#POPPER remote access trojan (RAT) and the OmniStealer information stealer.
Vendors
Products
Chrome extensionsInterview campaigns, PolinRider is targeting developers across NPM, Packagist, Go modules, and Chrome extensions.GitHubReferred to as PolinRider, the campaign has been ongoing since December 2025, using compromised GitHub repositories injected with JavaScript loaders leading to the DEV#POPPER remote access trojan (RAT) and theGo modulesDream Job, and ClickFake Interview campaigns, PolinRider is targeting developers across NPM, Packagist, Go modules, and Chrome extensions.npmOperation Dream Job, and ClickFake Interview campaigns, PolinRider is targeting developers across NPM, Packagist, Go modules, and Chrome extensions.PackagistOperation Dream Job, and ClickFake Interview campaigns, PolinRider is targeting developers across NPM, Packagist, Go modules, and Chrome extensions.