Detection & Defense · opensourcemalware.com

Developer Guide Explains How to Contain and Remove the PolinRider Malware

Aug 13, 2026 · Original article ↗

Summary

A field-tested guide explains how PolinRider infects and re-infects developers, spreads through repositories and packages, steals credentials, and how to contain it, clean affected systems and repositories, and rotate exposed credentials.

Key points

The DPRK-linked campaign reportedly grew to affect more than 2,000 GitHub owners and compromise over 4,000 repositories by July 2026.
Infection routes include fake coding interviews, trojanized developer packages, and poisoned repositories or packages shared by infected developers.
PolinRider steals credentials and secrets, then uses local access to inject malicious code into repositories and push changes, potentially spreading through developer accounts and packages.
The guide recommends disabling automatic VS Code tasks, restricting force-pushes, pausing CI/CD deployments, notifying collaborators, and blocking listed malicious IPs during remediation.
Cleanup should cover infected files and persistence artifacts on both local machines and GitHub repositories; the article warns that the provided scanner checks only older indicators and misses some infection paths.
Developers are advised to rotate all potentially exposed credentials, including cloud, browser, password-manager, package-registry, and CI/CD secrets, then audit repositories and collaborator access.
The article says Go modules already cached by proxy.golang.org may remain downloadable even after the source repository is cleaned or removed.

Article Details

Defense Focus: Detect, contain, and eradicate PolinRider across developer machines, repositories, credentials, and connected CI/CD systems; prevent reinfection through poisoned projects and repositories.
Detection Methods: Inspect JavaScript and TypeScript configuration files for appended obfuscated payloads, including unusually long whitespace and file sizes around 5,000 bytes rather than the usual 80–200 bytes.
Search for the campaign’s known payload markers, while accounting for the reported change from rmcej%otb% to Cot%3t=shtP and the decoder-function change from _$_1e42 to MDy.
Check for fa-solid-400.woff2, spellright.dict, suspicious .vscode/tasks.json folderOpen tasks, temp_auto_push.bat, and config.bat.
Inspect npm/lib/cli.js for an unexpectedly large file with an appended payload; the article reports a malicious version around 1 MB.
Run polinrider-scanner.sh against project directories, but treat a clean result as preliminary because it checks the original signature and does not check several newer artifacts.
Review running Node and Python process command lines, launch agents and daemons, shell startup files, scheduled jobs, and macOS Keychain access prompts.
Review git reflog, GitHub pull-request activity for force-push events, branch history, and unexpected Unverified commits.
For relevant npm publishing environments, monitor outbound traffic to the Telegram bot API as well as the listed malicious IPs.
Data Sources: Local JavaScript and TypeScript configuration files, task files, font and dictionary files, and npm/lib/cli.js
Running process names and command lines
Git reflog and local repository contents
GitHub pull-request activity, branch history, and commit verification status
Launch agents and daemons, shell startup files, scheduled jobs, and macOS Keychain prompts
Firewall and network egress telemetry
CI/CD platform credentials, app authorizations, and repository access
Rule Types: Shell-based file and artifact scanner polinrider-scanner.sh, suitable for a CI check
Shell and grep-based process and persistence checks
File-size and content-signature checks for configuration files and npm/lib/cli.js
Firewall block rules for the article-listed malicious IP addresses
Platforms: GitHub
Visual Studio Code
npm
Windows
macOS
Linux
Defensive Actions: Disable automatic VS Code task execution globally or set it to prompt before reopening potentially infected projects.
Temporarily block the listed malicious IPs at the network boundary.
Protect all reachable repositories against force-pushes; require pull requests and, where practical, signed commits.
Pause CI/CD auto-deployments and suspend unrecognized or unnecessary OAuth App and GitHub App authorizations.
Notify collaborators, organization members, known forks, and downstream package consumers; inspect collaboration and fork relationships for continuing propagation.
Contain live processes and inspect persistence locations before rotating credentials, so resident malware cannot immediately harvest replacements.
Clean identified files both on the developer machine and directly in GitHub repositories; do not rely on a local pull to reveal all poisoned content.
Rotate all potentially exposed credentials, including GitHub access, cached Git credentials, CI/CD tokens, environment-file secrets, cloud and database credentials, browser-saved passwords, password-manager contents, and npm registry tokens.
Audit every repository the affected account can access, using GitHub force-push activity and commit verification as evidence in addition to local Git history.
Run antivirus as an additional check, but do not treat a clean result as evidence that the system is clear.

Indicators of compromise

Type	Indicator	Context
IPV4	`136[.]0[.]9[.]8`	Listed as a known malicious IP for interim firewall blocking during PolinRider remediation.
IPV4	`154[.]91[.]0[.]103`	Listed as a known malicious IP for interim firewall blocking during PolinRider remediation.
IPV4	`166[.]88[.]134[.]82`	Listed as a known malicious IP for interim firewall blocking during PolinRider remediation.
IPV4	`166[.]88[.]4[.]2`	Listed as a known malicious IP for interim firewall blocking during PolinRider remediation.
IPV4	`166[.]88[.]54[.]158`	Listed as a known malicious IP for interim firewall blocking during PolinRider remediation.
IPV4	`188[.]43[.]33[.]249`	Listed as a known malicious IP for interim firewall blocking during PolinRider remediation.
IPV4	`198[.]105[.]127[.]210`	Listed as a known malicious IP for interim firewall blocking during PolinRider remediation.
IPV4	`202[.]155[.]8[.]173`	Listed as a known malicious IP for interim firewall blocking during PolinRider remediation.
IPV4	`23[.]27[.]120[.]142`	Listed as a known malicious IP for interim firewall blocking during PolinRider remediation.
IPV4	`23[.]27[.]13[.]43`	Listed as a known malicious IP for interim firewall blocking during PolinRider remediation.
IPV4	`23[.]27[.]202[.]27`	Listed as a known malicious IP for interim firewall blocking during PolinRider remediation.