PolinRider Campaign Expands to 4,367 Malicious GitHub Repositories
Summary
A July hunt found 2,417 newly compromised repositories linked to PolinRider, bringing the reported total to 4,367 across 2,152 owners. The campaign primarily injects payloads into project config files and also uses malicious font files.
Key points
- The report attributes PolinRider to the Lazarus Group and says the campaign’s confirmed footprint reached 4,367 repositories across 2,152 owners by July 9, 2026.
- The July hunt identified 2,417 repositories, 2,415 of which were not in the April dataset; the researchers say the confirmed count likely understates the campaign’s reach.
- Config-file injection accounted for 2,270 repositories (93.9%); 142 (5.9%) used JavaScript concealed in .woff2 font files, and five had both config-file and TasksJacker payloads.
- The campaign heavily affected individual developers: 2,260 repositories belonged to personal accounts, compared with 157 owned by organizations.
- Payloads were found in build and project configuration files including postcss.config.mjs, tailwind.config.js, and eslint.config.mjs, which can run automatically during project setup or builds.
- The article provides signature markers and file-search commands for identifying the reported variants, and advises treating affected development environments as compromised, rotating secrets, auditing persistence, and reviewing GitHub activity.
Article Details
- Attack Vectors
- Lazarus Group compromised public GitHub repositories by submitting malicious pull requests and injecting obfuscated JavaScript into project configuration files, including postcss.config.mjs, tailwind.config.js, and eslint.config.mjs. The payload executes during project installation, opening, or build activity.
- The campaign smuggled JavaScript payloads inside .woff2 font files, including public/fonts/fa-solid-400.woff2.
- The article reports that some repositories carried both PolinRider config injections and a TasksJacker .vscode/tasks.json payload.
- The campaign spread further through victims' GitHub accounts by pushing the payload to their repositories.
- Defensive Notes
- Treat configuration and font files from unfamiliar frontend templates, take-home coding tests, or project starters as untrusted; inspect them before use.
- Search projects for the reported variant markers and decoder functions: rmcej%otb%, _$_1e42, global['!'], Cot%3t=shtP, function MDy(f), and global['_V'].
- Inspect suspiciously large or recently changed fa-solid-400.woff2 files and audit postcss.config.mjs, tailwind.config.js, and eslint.config.mjs across projects.
- If a marker is found, the article recommends treating the development environment as fully compromised, deleting affected directories, rotating secrets, auditing persistence locations, checking browser password stores and crypto-wallet access times, and reviewing GitHub for unauthorized pushes.
MITRE ATT&CK
T1059.007 · JavaScriptThe payload is obfuscated JavaScript injected into project configuration files and executes during project installation, opening, or builds.T1102 · Web ServiceThe article says both variants use blockchain dead-drop infrastructure on TRON, Aptos, and BSC.T1195.001 · Compromise Software Dependencies and Development ToolsThe campaign compromises developer projects by submitting malicious pull requests that inject payloads into repositories.
Threat Actors
Malware
InvisibleFerretScan for InvisibleFerret Windows artifacts (detailed in the reverse-engineering section of the previous post).PolinRiderIn the three months since we discovered the PolinRider campaign, we've observed it growing to become a major source of malicious activity. We recently completed a fresh hunt that surfaced an entire new wave of victims:TasksJackerKorean state-sponsored) campaign that emerged in 2026. Initially it weaponized credentials stolen by TasksJacker, and we consider it a parallel or sub-campaign to Contagious Interview. The threat actor forks popular
Products
GitHubindividual job-seekers rather than hardened organizations, and it still spreads through the victims’ own GitHub accounts. What this round makes newly clear is the shape of the campaign — config files are the frontNext.jstogether account for the large majority of hits. These are files that ship with nearly every modern Next.js / React frontend, run as part of the build, and are almost never inspected line-by-line during codeReactaccount for the large majority of hits. These are files that ship with nearly every modern Next.js / React frontend, run as part of the build, and are almost never inspected line-by-line during code review...which