Loading malware…
PolinRider is a DPRK-linked malware campaign and loader family associated with Lazarus Group activity, particularly the Contagious Interview cluster. It targets software developers and software supply chains by compromising legitimate repositories, maintainer accounts, package releases, and browser extensions across ecosystems including GitHub, npm, Go modules, Packagist, and the Chrome Web Store. The operation has been observed using fake job-interview lures, poisoned repositories, malicious VS Code task configurations, typosquatted or compromised packages, and account compromise to place obfuscated JavaScript implants where developers are likely to execute or import them.
The malware commonly hides in JavaScript configuration files, bundled package code, fake font assets, and IDE task files. Execution may occur when a repository is opened in developer tooling, when a package is imported at runtime, or when install-time hooks run. A defining trait is its use of public blockchain infrastructure as a dead-drop mechanism: loaders query TRON, Aptos, Ethereum, or BNB Smart Chain data to resolve encrypted next-stage payloads or command-and-control locations, then decrypt and execute them dynamically. This design reduces reliance on fixed attacker-hosted staging infrastructure and supports rapid payload rotation.
Observed PolinRider chains include multi-stage JavaScript loaders, detached child-process execution, and follow-on malware such as DEV#POPPER, InvisibleFerret, BeaverTail-related tooling, and OmniStealer. Reported capabilities include remote command execution, system and environment discovery, credential and browser-data theft, cryptocurrency-wallet theft, clipboard collection, keylogging, persistence through modification of developer applications and tooling, and exfiltration of stolen data. The campaign has also been tied to automated propagation from already compromised developer machines, using stolen Git and package-publishing credentials to backdoor additional repositories and publish malicious releases under legitimate maintainer identities. In repo-sourced ecosystems such as Go modules and Composer packages, this makes repository compromise effectively equivalent to package compromise.
PolinRider tradecraft also includes defense evasion through obfuscation, preservation of legitimate package functionality, appending malicious code to trusted artifacts, force-pushed or anti-dated commits, and Git history rewriting to conceal tampering. Victimology is centered on individual developers, open-source maintainers, and organizations whose build pipelines or developer workstations can be leveraged for broader supply-chain intrusion. The campaign is notable for combining developer-focused social engineering, repository compromise, blockchain-backed staging, and modular post-exploitation payload delivery into a sustained ecosystem-wide intrusion set.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
북한 라자루스(Lazarus)로 추정 구글 크롬 웹 스토어 PolinRider 악성코드 분석-YouTube Translator: Captions, Transcript & AI Summary로 유포되고 있는 악성코드
Security researchers have uncovered a campaign called PolinRider that hides malicious JavaScript loaders inside trusted code repositories, waiting for unsuspecting developers to run them.
OpenSourceMalware’s PolinRider reporting describes the same loader architecture as culminating in a DPRK BeaverTail variant and repository-propagation backdoor/infostealer behavior.
27 distinct techniques documented for this family, organized by ATT&CK tactic.
the malware still... spreads through the victims’ own GitHub accounts... Review your GitHub account for unauthorized pushes — the campaign spreads by pushing the payload back out through victim accounts.
"PolinRider Caused Dozens of npm and Go Compromises" ... #SupplyChain, #GitHub, #NPM, #InvisibleFerret, #OmniStealer, #PolinRider
It's careful work: they pulled together nine malicious packages, a 77KB remote access trojan (RAT) ... Here's a chronological look at the typosquatted packages.
Audit persistence: SSH authorized_keys , crontabs, launchd agents (macOS), systemd services (Linux), and scheduled tasks (Windows).
A Windows script rewrites git history to hide the tampering... temp_auto_push.bat still rewrites the latest commit... bypasses pre-commit hooks with --no-verify , and force-pushes to erase the evidence.
.vscode/tasks.json with a runOn: folderOpen trigger that curl-pipes a shell command the instant a victim opens the project.
Les deux versions malveillantes contiennent un implant JavaScript injecté au moment du bundling ... qui s’exécute au chargement du module (import-time)
Audit persistence: SSH authorized_keys , crontabs, launchd agents (macOS), systemd services (Linux), and scheduled tasks (Windows).
Stage 0 – Bootstrap : Obfuscation multi-couches (shuffle de caractères, table de chaînes, décompresseur, Function() dynamique)
L’implant utilise un mécanisme de résolution de payload via des transactions blockchain publiques (Tron, Aptos, BNB Smart Chain) pour récupérer du code chiffré, le déchiffrer par XOR, et l’évaluer dynamiquement.
ChainVeil's packages (tailwindcss-merge, tailwindcss-animates-kit, clsx-tailwind) ... typosquat the same narrow slice of the Tailwind and Vite tooling namespace.
Four weeks later, on July 14, they followed up with a sequel on "ViteVenom," seven typosquats targeting the Vite ecosystem.
The fallback C2 path adds persistence: if the primary eval() fails, the payload is launched as a detached node -e child process with windowsHide: true and stdio: 'ignore'
A Windows script rewrites git history to hide the tampering, making it look like a normal commit... temp_auto_push.bat still rewrites the latest commit to preserve its original timestamp... and force-pushes to erase the evidence.
the malware still... spreads through the victims’ own GitHub accounts... Review your GitHub account for unauthorized pushes — the campaign spreads by pushing the payload back out through victim accounts.
The loader still resolves its second stage from blockchain dead-drops across TRON, Aptos, and BNB Smart Chain, decrypts it with embedded XOR keys...
Try Tron first... catch (e) { // Fallback to Aptos ... } ... try { txInput = await fetchFromBSC('bsc-dataseed.binance.org'); ... } catch (e) { txInput = await fetchFromBSC('bsc-rpc.publicnode.com'); }
"Joyfill npm Packages Compromised with Blockchain C2 Loader"
Loader de 5 849 octets configurant le endpoint Socket.IO (166.88.134.62:443) ... Requête vers 23.27.13.43/$/boot avec header Sec-V: A9-0135-3
The C2 resolution chain is identical... Tron ... The result is a BSC transaction hash. BSC ... decode ... XOR decrypt with the hardcoded key and eval().
The blockchain dead drop (still live) ... Tron: Query TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP ... The result is a BSC transaction hash.
60 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
26 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a DPRK-linked campaign/tooling pattern whose package-hijacking behavior resembled the current npm malware activity.
Malicious code distributed via a Google Chrome Web Store extension masquerading as 'YouTube Translator: Captions, Transcript & AI Summary.' The post attributes the campaign to suspected Lazarus activity.
A DPRK-associated malware campaign targeting developers by compromising legitimate packages, fake job interviews, poisoned code repositories, malicious VS Code tasks, and deceptive software packages to compromise developer machines and accounts, steal credentials, clone repositories, and insert backdoored code while maintaining persistent access.
Named campaign/malware used as an example of DPRK tradecraft where the malicious artifact may reside outside the npm tarball, limiting the effectiveness of publish-time tarball scanning.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.