PolinRider Campaign Spreads 108 Malicious Packages and Browser Extensions
Summary
Researchers link PolinRider, tied to North Korea-aligned Contagious Interview, to 108 malicious packages and extensions. The campaign abuses developer tooling and repositories to deliver BeaverTail variants and payloads including DEV#POPPER RAT and OmniStealer.
Key points
- The activity reportedly spread 108 unique malicious packages and extensions across npm, Packagist, Go, and Chrome, represented by 162 release artifacts.
- The campaign targets software developers and cryptocurrency workers through fake recruitment and job-interview schemes.
- Attackers reportedly exploit maintainer accounts and legitimate repositories, using obfuscated JavaScript loaders and VS Code tasks configured to run when a folder opens.
- The malware searches for development configuration files and can append malicious JavaScript; a Windows batch script also modifies commit history to disguise changes.
- The latest payload chain reportedly contacts services on TRON, Aptos, and BNB Smart Chain to retrieve an encrypted second stage that unpacks to DEV#POPPER RAT and OmniStealer.
- OpenSourceMalware reported that, as of April 11, 2026, the activity had compromised 1,951 public repositories associated with 1,047 owners.
- Recommended steps for affected users include rotating exposed secrets from a clean machine, removing affected package versions, rebuilding from a known-good lockfile, and auditing repositories and workstations.
Article Details
- Attack Vectors
- Malicious packages and browser extensions published through npm, Packagist, Go, and Google Chrome.
- Fake job interviews and assessments used to persuade software developers and cryptocurrency workers to execute malicious code.
- Malicious VS Code task files configured to run when a repository folder is opened, and obfuscated JavaScript loaders planted in repositories.
- Compromised maintainer accounts used to publish infected package versions; the article says the suspected takeover methods may include expired-domain takeover or another account-recovery path.
- Defensive Notes
- Treat systems that installed the identified packages as compromised; rotate exposed secrets from a clean machine.
- Remove affected package versions and rebuild from a known-good lockfile.
- Audit developer workstations and repositories for hidden execution paths, suspicious commits, and changes to .vscode/tasks.json, config.js, vite.config.js, and eslint.config.js.
- Review repository activity logs, package release metadata, and VS Code task configuration; visible GitHub landing pages and commit histories may be unreliable because of history rewriting.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe campaign conceals JavaScript loaders with obfuscation and whitespace padding, and disguises payloads as .woff2 font files.T1059.003 · Windows Command ShellA Windows batch script is used to modify Git commit history.T1059.007 · JavaScriptObfuscated JavaScript loaders and appended JavaScript payloads execute on infected developer systems.T1105 · Ingress Tool TransferThe JavaScript loader fetches an encrypted second-stage payload from blockchain infrastructure.T1195.001 · Compromise Software Dependencies and Development ToolsMalicious packages and extensions were published through software ecosystems, including releases made using compromised maintainer accounts.T1565.001 · Stored Data ManipulationAttackers rewrite Git history, including force pushes and anti-dated commits, to disguise malicious repository changes.
People
Malware
BeaverTailThe campaign uses compromised maintainer accounts, malicious VS Code tasks, and hidden JavaScript loaders to spread BeaverTail variants and payloads such as DEV#POPPER RAT and OmniStealer.DEV#POPPERThe campaign uses compromised maintainer accounts, malicious VS Code tasks, and hidden JavaScript loaders to spread BeaverTail variants and payloads such as DEV#POPPER RAT and OmniStealer.OmniStealerThe campaign uses compromised maintainer accounts, malicious VS Code tasks, and hidden JavaScript loaders to spread BeaverTail variants and payloads such as DEV#POPPER RAT and OmniStealer.
Products
CursorThe VS Code tasks include the “runOn: ‘folderOpen’” option to trigger the execution of arbitrary code when the folder is opened as a workspace folder in an IDE like VS Code or Cursor.GitHubAttackers masquerade as recruiters or collaborators on platforms like LinkedIn, GitHub, or freelance websites, often setting up elaborate front companies and AI-generated employee profiles to build trust and ultimatelyGoogle ChromeNorth Korean threat actors tied to the Contagious Interview campaign have published 108 malicious packages and browser extensions across npm, Packagist, Go, and Google Chrome as part of the ongoing PolinRider activity.VS CodeThe campaign uses compromised maintainer accounts, malicious VS Code tasks, and hidden JavaScript loaders to spread BeaverTail variants and payloads such as DEV#POPPER RAT and OmniStealer.