PolinRider Campaign Expands to Nearly 2,000 Repositories, Researchers Link It to TasksJacker

Apr 12, 2026 · Original article ↗

Summary

Researchers identified 1,951 compromised repositories and 1,047 owners linked to PolinRider, and estimate the true scope may reach 2,000–3,000 repos. They report shared tooling with TasksJacker and provide hunting and cleanup guidance.

Key points

The researchers found 1,951 unique affected repositories across 1,047 owners, up from 675 repositories and 352 owners in March; they estimate the real total may be 2,000–3,000.
A new obfuscation signature, `Cot%3t=shtP`, was found alongside the original marker. At least one repository reportedly contains both variants, suggesting reinfection.
The researchers say PolinRider and TasksJacker now share victims, delivery methods and tooling, including malicious npm packages, `.vscode/tasks.json` commands and JavaScript hidden in fake font files.
Two weaponized developer take-home templates were identified: ShoeVista, which includes a malicious npm dependency, and StakingGame, whose VS Code task runs a remote command when the project opens.
The campaign uses attacker-controlled Vercel subdomains for initial delivery and blockchain transactions on TRON, Aptos and BSC for payload retrieval, according to the analysis.
Researchers recommend checking project configuration files, font assets and propagation-script artifacts, and rotating secrets and auditing persistence if a fake interview project may have run.
The team submitted 821 new threat reports and says its scanner will be updated to cover the new variant and campaign indicators.

Article Details

Attack Vectors: A malicious npm package included in fake take-home projects runs the PolinRider JavaScript loader during npm install/build.
A .vscode/tasks.json task configured with runOn: folderOpen uses curl to retrieve shell commands from attacker-controlled Vercel subdomains and pipes them to a shell.
Obfuscated JavaScript is injected into developer configuration files; a variant was also hidden in a fake .woff2 font file.
The loader retrieves encrypted second-stage payloads from blockchain transactions on TRON, Aptos, or BSC.
A Windows propagation script rewrites the most recent Git commit and force-pushes changes.
Defensive Notes: Scan for both PolinRider and TasksJacker indicators, including configuration files, .vscode/tasks.json, public font files, and temp_auto_push.bat.
Use the updated multi-variant detection rule for both rmcej%otb% and Cot%3t=shtP, and monitor for the listed Vercel /settings paths.
Treat cloned fake take-home projects as potentially executed malware: remove the project and node_modules, rotate secrets present in the build environment, and audit SSH keys, scheduled tasks, services, browser password stores, wallets, and Git account activity.
On Windows, check for InvisibleFerret artifacts.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`260120[.]vercel[.]app`	Identified as a C2 or staging host used by the TasksJacker task-file cluster.
DOMAIN	`default-configuration[.]vercel[.]app`	Attacker-controlled Vercel subdomain identified as a first-stage bootstrap C2 host.
DOMAIN	`vscode-bootstrapper[.]vercel[.]app`	Attacker-controlled Vercel subdomain identified as a first-stage bootstrap C2 host.
DOMAIN	`vscode-load-config[.]vercel[.]app`	Attacker-controlled Vercel subdomain identified as a first-stage bootstrap C2 host.
DOMAIN	`vscode-settings-bootstrap[.]vercel[.]app`	Attacker-controlled Vercel subdomain identified as a first-stage bootstrap C2 host.
DOMAIN	`vscode-settings-config[.]vercel[.]app`	Attacker-controlled Vercel subdomain identified as a first-stage bootstrap C2 host.
URL	`hxxps[:]//vscode-extension-260120[.]vercel[.]app/task/mac`	Example attacker-used Vercel URL in a tasks.json command that retrieves content for shell execution.