Threat Actor
PolinRider
- First Reported
- Mar 8, 2026
- Latest Reported
- Aug 14, 2026
Reported Context (4)
- Described by Paul McCarty as a threat actor and campaign style associated with malicious code pushed to compromised assets; the source says its activity overlaps with NullReceiver use. GitHub Revokes npm 2FA-Bypass Token Privileges as DPRK’s NullReceiver Activity Grows
- The article attributes the npm, Go, and Joyfill compromises and related developer-machine malware activity to the PolinRider campaign. PolinRider Linked to 20 Compromised npm and Go Packages
- The article identifies PolinRider with the credential-harvesting operation and its later fork-and-PR activity; the name also appears in Git commit metadata. TasksJacker Supply-Chain Campaign Uses Malicious VS Code Tasks and Blockchain C2
- OpenSourceMalware attributes the repository-compromise activity to this actor and the DPRK, describing the actor as a Lazarus group contributor connected to Contagious Interview and TasksJacker. PolinRider Campaign Injected Malware into 675 Public GitHub Repositories, Researchers Say
Malware (5)
People (1)
Threat Actors (2)
MITRE ATT&CK (19)
Vendors (2)
Products (13)
Tools (3)
Countries (3)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.