North Korean threat actors are escalating the PolinRider supply chain attack across Go, Packagist, and npm package environments.
The threat cluster – identified as Contagious Interview or Famous Chollima – continues to expand its targeting parameters well beyond initial npm registry exploits. Recent security telemetry exposes a widening attack surface, cataloguing 162 malicious release artifacts distributed across 108 unique packages.
Analysts from Socket have detected active compromise traces within 80 Go modules, 10 Packagist packages, and at least one Chrome extension. This ongoing operation relies on seizing legitimate maintainer accounts to modify trusted repositories, allowing attackers to publish infected package versions into enterprise deployment pipelines where they retain registry access.
Evasion tactics and payload distribution
The mechanics of the attack centre on planting obscured JavaScript loaders within seemingly benign project assets. Attackers frequently pad executable lines with excess whitespace to push the malicious code beyond the default viewing width of standard IDEs. In more complex deployments, the threat actors embed the loader entirely within fake .woff2 font files, masquerading the payload as a static visual asset.
Execution of these hidden payloads depends on the manipulation of local developer tooling rather than application runtime triggers. The attackers exploit Visual Studio Code task files to force execution. A modified .vscode/tasks.json file configures a hidden background task set to execute whenever an engineer opens the project folder. This configuration quietly passes the fake .woff2 font asset to Node.js, initiating the infection sequence before the developer even compiles the application.
Deobfuscation of the initial payload reveals a JavaScript loader programmed to interface with external blockchain networks. The loader reaches out to public RPC infrastructure running on TRON, BNB Smart Chain, and Aptos to extract encrypted second-stage payloads. Relying on decentralised Web3 architecture like Aptos provides the threat actors with resilient distribution mechanisms that bypass standard egress filtering and domain blacklisting. The loader decrypts the retrieved material using embedded XOR keys and executes the resulting code via the eval() function.
Current secondary payloads delivered through this mechanism include OmniStealer and DEV#POPPER. These malware variants facilitate total workstation compromise, enabling arbitrary command execution, credential harvesting, browser data theft, and cryptocurrency wallet exfiltration. The modular design of the initial loader ensures the attackers retain the capability to deploy entirely different malware strains as security controls adapt to current signatures.
Repository manipulation and access exploitation
Attackers execute Git force pushes and inject anti-dated commits to weave their code alterations into older maintenance updates. The visible commit history often appears benign, featuring routine messages from trusted maintainers. Identifying these stealth alterations requires security teams to conduct dedicated reviews of repository activity logs to spot retroactive history modifications and force pushes.
Recent compromises affecting the Xpos587 GitHub account illustrate the coordinated nature of these supply chain breaches. Multiple projects maintained by this single account received simultaneous updates within a narrow time window. This synchronised pattern indicates an account-level breach followed by bulk repository modification, completely distinct from standard per-project maintenance. The attackers successfully published infected Go modules to downstream registries under this compromised account. Telemetry indicates they lacked the necessary publishing credentials or registry access to push malicious Python versions to PyPI, despite modifying the related source repositories.
Similar infiltration occurred within the PHP ecosystem targeting the Packagist registry. The campaign breached the sevenspan namespace, managed by the 7span organisation. Internal maintainers identified the anomalous .woff2 files and initiated partial cleanup procedures. However, they missed secondary payload variants hidden directly within configuration files such as vite.config.js and eslint.config.js. The remediation effort focused on a single evasion tactic, leaving obscured JavaScript fully active within the repository infrastructure.
The breach of a single developer workstation through poisoned packages can expose an entire corporate network to lateral movement. Attackers prioritise the theft of high-value authentication tokens over immediate disruptive actions. The theft of Kubernetes credentials, for example, grants threat actors direct administrative access to production infrastructure.
Threat intelligence analysis confirms that the primary objective involves establishing persistent footholds within enterprise continuous integration and continuous deployment (CI/CD) pipelines. Once attackers secure access to the CI/CD environment, they can inject malicious artifacts into proprietary corporate software builds, converting the victim organisation into an active distributor of downstream supply chain attacks.
See also: Harness: AI code generation exposes pipeline limitations
Want to learn more about cybersecurity from industry leaders? Check out Cyber Security & Cloud Expo taking place in Amsterdam, California, and London. The comprehensive event is part of TechEx and is co-located with other leading technology events including the AI & Big Data Expo. Click here for more information.
Developer is powered by TechForge Media. Explore other upcoming enterprise technology events and webinars here.