PolinRider Campaign Injected Malware into 675 Public GitHub Repositories, Researchers Say
Summary
OpenSourceMalware reports 675 public repositories across 352 owners contained PolinRider payloads. The malware can execute code retrieved from blockchain transactions; researchers attribute the campaign to DPRK-linked actors, while the initial infection vector remains未
Key points
- OpenSourceMalware says it found malicious JavaScript in 675 public GitHub repositories belonging to 352 owners as of March 8, 2026.
- The payload is appended to JavaScript project configuration files and runs when build tools import them.
- Researchers describe the initial infection vector as uncertain; they cite a compromised npm package and a malicious VS Code extension as possible routes.
- The malware retrieves XOR-encrypted JavaScript from TRON, Aptos, or Binance Smart Chain transactions, then decrypts and executes it.
- A Windows batch file can amend the latest Git commit while preserving its timestamp and force-push the rewritten history, according to the analysis.
- The researchers attribute the campaign to DPRK and associate PolinRider with Lazarus Group-related activity; these are their assessments.
- Recommended steps include auditing JavaScript config files and dependencies, rotating exposed secrets, and checking systems with the researchers’ detection guidance.
Article Details
- Attack Vectors
- A suspected compromised npm package executes during installation or build and appends obfuscated JavaScript to project configuration files. The exact initial dropper remains unknown; the researchers also identify malicious VS Code extensions as a possible entry vector.
- Injected configuration modules execute automatically when imported by build tools, extending exposure to downstream users and contributors.
- The actor published malicious npm packages named tailwind-mainanimation and tailwind-autoanimation. The latter appends the payload to src/index.js.
- A Windows batch script amends the latest Git commit, preserves its apparent author, message, and timestamp, bypasses Git hooks, and force-pushes infected content.
- Blockchain transaction data supplies encrypted JavaScript payloads, which are decrypted and executed at runtime. Detached child processes allow execution to survive parent termination.
- Defensive Notes
- Audit JavaScript configuration files for unexpected content after export default or module.exports, particularly whitespace-padded appended code.
- Search for the signatures rmcej%otb%, the seed 2857687, and global['!']='8-270-2';var _$_1e42=.
- Review recently added or updated dependencies and postinstall scripts, especially scripts that modify project-root configuration files.
- Rotate secrets, tokens, and credentials that were present in affected build environments.
- Remove injected payloads, delete temp_auto_push.bat and config.bat when present, and remove config.bat entries from .gitignore.
- Inspect globally installed npm packages and VS Code extensions for the initial dropper, then force-push clean repository contents and consider signing commits.
- The supplied scanner flags Git reflog anomalies only alongside other compromise findings.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxps[:]//api[.]trongrid[.]io/v1/accounts/TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP/transactions | Specific TRON account transaction resource queried by the malware to retrieve encrypted JavaScript payloads for its primary blockchain-based C2 mechanism. |
MITRE ATT&CK
T1008 · Fallback ChannelsThe loader falls back from TRON to Aptos and retries using secondary addresses and a secondary decryption key.T1027 · Obfuscated Files or InformationThe JavaScript payload uses multiple character-shuffling layers, a substitution cipher, encrypted strings, and XOR-encrypted final payloads.T1059.003 · Windows Command ShellThe Windows propagation batch script invokes cmd and Git commands to amend commits and force-push infected files.T1059.007 · JavaScriptInjected JavaScript constructs and executes payloads through eval(), including code retrieved from blockchain transactions.T1083 · File and Directory DiscoveryThe malware searches the local computer for configuration and application files such as postcss.config.mjs, tailwind.config.js, and App.js before appending malicious code.T1102.001 · Dead Drop ResolverThe malware uses blockchain transactions accessed through public APIs as a dead drop for encrypted executable payloads.T1105 · Ingress Tool TransferThe loader retrieves additional encrypted JavaScript from blockchain account transaction data.T1140 · Deobfuscate/Decode Files or InformationRuntime routines reconstruct strings and function names and XOR-decrypt blockchain-delivered JavaScript before execution.T1195.001 · Compromise Software Dependencies and Development ToolsMalicious npm packages and injected source repositories distribute JavaScript that executes during dependency import or project builds.
Threat Actors
Lazarus GroupThe researchers describe PolinRider as a contributor to this group; the article does not establish that the two names are aliases.PolinRiderOpenSourceMalware attributes the repository-compromise activity to this actor and the DPRK, describing the actor as a Lazarus group contributor connected to Contagious Interview and TasksJacker.
Malware
Products
GitHubThe OpenSourceMalware team uncovered a massive threat campaign that implants malware in GitHub users and organizations repositories. We attributed this campaign to the DPRK, and the threat actor PolinRider is a knownMicrosoft Windowsheavily obfuscated malicious JavaScript code to the end of that file. Next, the malware installs a Windows batch file, named tempautopush.bat. We know this file exists and what it does because the threat actorsNeutralinojsThis attack has been enormously successful, with one compromised open source project, Neutralinojs spreading the malware to hundreds of its users and contributors (see our research here). Neutralinojs is a very popularnpmmaking it easy to miss during casual code review. The primary infection vector appears to be a compromised npm package that executes during install or build and injects itself into config files in the project root.VS Codeactor is not using stolen GitHub credentials. Instead, the victims have been compromised via a malicious VS Code extension or NPM package. We don't know yet what that initial vector is, but we know what it does from