PolinRider Malware Tests New Payload Variants to Evade Detection

Sep 26, 2026 · Original article ↗

Summary

Researchers traced PolinRider across three development repositories, documenting changing payload names, paths, and extensions, plus repeated force-pushes that restored malware after cleanup. They say the variants appear to be tested in parallel.

Key points

PolinRider infected three Binary-Mindz repositories for months, using VS Code folder-open tasks and executable JavaScript payloads disguised as font files.
Payloads changed names, file locations, extensions, obfuscation, and execution methods; the latest observed variant used the unfamiliar .llf extension.
The malware force-pushed rewritten commits across branches, preserving familiar authors, messages, and dates. Researchers counted 853 force-pushes.
Three cleanup attempts were reversed by pushes from other contributors’ accounts, consistent with infected developer machines continuing to rewrite repositories.
One payload used an Ethereum-wallet dead drop to resolve command-and-control infrastructure; researchers had not yet decoded the 900 variant.
Recommended checks include inspecting font files by content, reviewing executable project configuration, scanning every branch, monitoring force-pushes, and cleaning infected machines.

Article Details

Attack Vectors: Opening an infected project in VS Code triggers folderOpen tasks that execute JavaScript payloads disguised as font files, including .woff2 and .llf files, through Node.
A VS Code task downloads and runs scripts from the specified 260120.vercel[.]app URLs using shell commands.
Obfuscated JavaScript appended to eslint.config.mjs executes when ESLint loads the configuration.
A prisma.config.ts loader decodes a URL from an environment variable, fetches code, and evaluates it; the article reports this as a past variant.
On an infected developer machine, PolinRider rewrites commits in accessible repositories and force-pushes them across branches, restoring payloads after cleanup.
Defensive Notes: Inspect font-directory files by content; the article says PolinRider’s fake fonts are plain text, regardless of filename or extension.
Review what tasks.json executes, including hidden and non-hidden folderOpen tasks. Parse it as JSONC so comments or trailing commas do not cause it to be skipped.
Inspect executable configuration files such as eslint.config.mjs and prisma.config.ts for unexpected code, unusually long lines, or content after expected exports.
Review every branch and GitHub activity logs for bursts of force-pushes, and treat the listed .gitignore entries as a sign that a contributor machine may be infected.
Clean infected contributor machines as well as repositories; otherwise, the article says the malware can restore removed payloads.
Disable automatic tasks for untrusted projects, examine task.allowAutomaticTasks, and protect all relevant branches against force-pushes and unsigned commits.

Indicators of compromise

Type	Indicator	Context
SHA256	`1a21bad1df69b51efebfd2fae849ac27722b0dfac7b1cb459cf81d38b36f9705`	Hash of the malicious fa-solid-900.woff2 payload.
SHA256	`3b572a613f5013a64e1877dfed3873f2bcbd52e5259b199d41e02c33840abbcb`	Hash of the malicious fa-solid-300.llf payload.
SHA256	`6200054e0ea8575c3af37e4da10e23249bf0a17d1d6843ecc81ee35af2f7d1f2`	Hash of the malicious tasks.json file that runs fa-solid-300.llf in GulamRosul/Curved-navigation-bar.
SHA256	`90a3875ff84a53473107a03cec6ad19636da0cc0eccb02c036d03b8f2a5dff28`	Hash of the same malicious tasks.json file with Windows line endings, reported in two Binary-Mindz repositories.
SHA256	`91e334655d31f84963e6b9369d41698f51b00d7a203cf314ceba01780e6f337c`	Hash of the malicious eslint.config.mjs file at commit 1b16bd46b7.
SHA256	`fbf0e36dd7eb1e70fc4868a8d0d0cd8f6c80753241cd88a3518f40e9a67d232e`	Hash of the malicious .vscode/tasks.json file at commit 1b16bd46b7.
URL	`hxxps[:]//260120[.]vercel[.]app/settings/linux?flag=9-test`	Malicious script-delivery URL used by the VS Code task on macOS and Linux.
URL	`hxxps[:]//260120[.]vercel[.]app/settings/win?flag=9-test`	Malicious script-delivery URL used by the VS Code task on Windows.