PolinRider Linked to 20 Compromised npm and Go Packages

Jul 31, 2026 · Original article ↗

Summary

An analysis links 20 compromised npm and Go packages to PolinRider, detailing how malware used developer access to spread payloads, steal credentials, and backdate commits. Malicious Go module versions remain available from the proxy cache.

Key points

Shared XOR keys, Tron wallets, and other indicators link all 20 packages to PolinRider; the analysis says the spread resulted from automated propagation after developer machines were infected, not deliberate account takeovers.
The 16 affected Go modules carried an obfuscated JavaScript loader that retrieved encrypted payloads via blockchain RPC infrastructure and launched credential-stealing malware.
A local script used developers’ existing Git credentials to add malicious commits and forge their timestamps; 11 of the 16 Go module timestamps were verified as forged.
Go’s write-once proxy cache still serves the malicious module versions, even after eight associated accounts were removed or deleted.
Two npm packages used a VS Code folder-open task to run a disguised JavaScript loader; the Joyfill beta packages instead executed appended malicious code when required.
The reported payloads include InvisibleFerret, DEV#POPPER, and OmniStealer, targeting credentials, browser data, crypto wallets, and developer tools.
The article recommends scanning repositories, reviewing Git history and VS Code tasks, securing Git access, and rotating npm tokens after suspected compromise.

Article Details

Attack Vectors: PolinRider compromises developer machines through fake interview or take-home assignment lures, poisoned repositories and forks, typosquatted packages, and malicious VS Code tasks.
A .vscode/tasks.json task configured with runOptions.runOn: 'folderOpen' executes a JavaScript loader disguised as public/fonts/fa-solid-400.woff2 when a project folder opens.
Malicious npm package code executes at require() time; compromised Go repositories receive malicious tagged commits, and compromised npm credentials can be used to publish poisoned package versions.
The loader resolves encrypted payloads through blockchain RPC infrastructure, decrypts them with an embedded XOR key, and executes JavaScript with eval().
The malware harvests browser credentials, crypto wallets, password-manager data, developer-tool configurations, OS keystores, SSH keys, and npm tokens; it uses stolen access to alter repositories and distribute malicious packages.
A detached process retrieves a second-stage payload, while a backdoor provides interactive command execution, file transfer, and clipboard access.
Defensive Notes: Inspect developer machines and repositories for the .woff2 loader pattern, temp_auto_push.bat, config.bat, amended commits, and signs that ~/.npmrc was accessed.
Treat polinrider-scanner.sh as a first-pass check only: the article says it checks the original March signature, not the rotated signature or all blockchain-resolved and npm-token indicators.
For npm maintainers, rotate registry tokens if compromise is suspected. For Go maintainers, protect Git push access, use hardware-backed MFA on GitHub, and maintain clean SSH key hygiene.
Disable automatic task execution in VS Code or require a prompt before opening projects that were not created by you.

Indicators of compromise

Type	Indicator	Context
IPV4	`166[.]88[.]134[.]62`	Joyfill incident primary C2 address, reported on ports 443 and 80.
IPV4	`198[.]105[.]127[.]210`	C2 address identified as shared PolinRider infrastructure, reported on ports 443 and 80.
IPV4	`23[.]27[.]13[.]43`	Joyfill stage-two payload delivery address; the article also identifies it as novel to that incident.
IPV4	`23[.]27[.]202[.]27`	C2 address identified as shared PolinRider infrastructure, reported on ports 443 and 27017.
SHA256	`13e9a3c41e038bf9d8fcb0831305819819e4f7f4452bc20a04b9bf2756ee22e8`	SHA-256 hash reported for the malicious fa-solid-400.woff2 JavaScript loader found in Go modules.
SHA256	`53abf37710d6f2e35694fbe7cfaf1108127cbc001ce3e6bf994d0486cae5a0e8`	SHA-256 hash reported for the malicious fa-solid-400.woff2 JavaScript loader found in Go modules.
URL	`hxxp[:]//23[.]27[.]13[.]43/$/boot`	Defanged URL from which a detached process retrieves the Joyfill second-stage payload.