PolinRider: 108 Open Source Packages Poisoned — Act Now

North Korean hackers have published 162 malicious release artifacts across 108 open source packages — and the scariest part is not the payload. It’s that they rewrote the commit history first. PolinRider, a campaign attributed to the Contagious Interview cluster (Lazarus Group affiliate), now spans npm, Go modules, Packagist, and the Chrome Web Store. Your dependency scanner will not catch it. Your git log is a lie.

What PolinRider Is

First flagged in March 2026 by the OpenSourceMalware team, PolinRider had compromised 1,951 public GitHub repositories by April. The campaign has since expanded to four package ecosystems: 19 npm libraries, 61 Go modules, 10 Packagist/Composer packages, and one Chrome extension. Socket’s threat research team published updated findings this week confirming the campaign is still active.

The attribution points to the Contagious Interview / Famous Chollima cluster — the same North Korean state-sponsored operation behind years of fake job interview attacks that delivered malware to developers via poisoned take-home projects. PolinRider skips the fake interview entirely and goes straight for your dependencies.

The Attack You Can’t See: Git History Rewriting

The most dangerous element of PolinRider is not the malware itself — it’s the technique attackers use to make compromised packages look trustworthy. After gaining access to maintainer accounts via credential theft or expired-domain takeovers, attackers inject malicious code, then use Git force pushes with anti-dated commits to make those injections appear as historical, long-standing changes.

What this means in practice: the commit timeline you see on GitHub’s landing page is not a reliable trust signal for any package in this campaign. A package showing five years of clean commits may have had those commits rewritten last month. The only reliable check is the repository’s activity log — not the commit graph.

This is the part most coverage is missing. Developers routinely use commit history age as a proxy for package safety. PolinRider specifically and deliberately broke that heuristic.

How It Gets on Your Machine

The campaign uses four distinct delivery vectors, often combined:

• Whitespace-padded loaders in config files: Malicious JavaScript is added to vite.config.js, tailwind.config.js, or eslint.config.js with thousands of blank characters pushing the payload off-screen. You scroll through the file and see nothing suspicious.
• Fake .woff2 font files: Executable JavaScript disguised as static web font assets. Nothing about the filename triggers suspicion during code review.
• VS Code tasks.json auto-execution: A .vscode/tasks.json file with "runOn": "folderOpen" fires the payload the moment you open the project in VS Code or Cursor — before you read a single line of code. This is a legitimate VS Code feature, which is why security scanners rarely flag it.
• npm postinstall hooks: Traditional supply chain delivery, active in the tailwindcss-style-animate cluster of packages.

Once a loader runs, it contacts blockchain RPC endpoints — TRON, Aptos, and BNB Smart Chain — to retrieve an encrypted second-stage payload. Using blockchain infrastructure for command-and-control is deliberate: traditional URL-based blocklists have no purchase on public blockchain endpoints.

What the Malware Takes

The decrypted payload delivers two components. DEV#POPPER is a remote access trojan with socket.io-based command execution. OmniStealer harvests SSH keys, GitHub personal access tokens, cloud credentials, CI/CD secrets, and cryptocurrency wallets. Source code exfiltration is part of OmniStealer’s capability set. If you ran any affected package version, treat your development machine as fully compromised until audited from a clean system.

Known Affected Packages

Confirmed compromised packages include the npm packages tailwindcss-style-animate, tailwind-mainanimation, and tailwind-autoanimation; the Packagist packages thiio/kubernetes-php-sdk, sevenspan/laravel-whatsapp, and sevenspan/laravel-chat; and Go modules under the Xpos587 GitHub account, including Xpos587/git2md. The full, continuously updated list is at Socket’s live tracker.

Six Steps to Take Now

1. Do not rotate credentials from a potentially compromised machine. You may be logging keystrokes. Use a separate, clean device for all credential rotation.
2. Remove affected package versions and delete node_modules, vendor directories, and Go module cache. Rebuild from a verified, clean lockfile or go.sum.
3. Rotate all credentials from the clean machine: npm access tokens, GitHub PATs, cloud provider keys (AWS, GCP, Azure), CI/CD secrets, and SSH keys.
4. Audit .vscode/tasks.json in any repository you have cloned recently. Look for "runOn": "folderOpen" entries that execute unexpected commands.
5. Check GitHub Activity logs — not the commit timeline — on any repository you maintain or depend on. Look for force pushes and unexpected release publishes that do not match your expected release cadence.
6. Grep config files and .woff2 assets for the loader signatures _$_1e42 and rmcej%otb%, and for abnormally long horizontal whitespace in JavaScript files.

The Bigger Problem

PolinRider is not the last campaign that will forge commit history. The entire open source trust model rests on the assumption that what you see on GitHub is what was always there. Force-push poisoning with anti-dated commits breaks that assumption permanently. Checking a package’s age or contributor history is no longer sufficient due diligence.

Use software composition analysis tools that analyze package behavior at install time — Socket, Snyk, or Dependabot advanced scanning — rather than relying on commit metadata. And update your threat model: supply chain attacks now include attacks on the metadata you use to evaluate supply chain risk. The Hacker News has the full campaign breakdown for teams that want to brief their security leads.