PolinRider: North Korea-Linked Supply Chain Campaign Expands Across Open Source Ecosystems
North Korean threat actors expand PolinRider supply chain campaign across npm, Packagist, Go, and Chrome extensions.
The PolinRider supply chain campaign, linked to North Korean threat actors, has expanded its reach across multiple open source ecosystems including npm, Packagist, Go modules, and Chrome extensions. Threat actors are compromising maintainer accounts, rewriting Git history, and hiding malicious JavaScript loaders within legitimate repositories, often disguised as font files or within configuration files. The campaign has been observed delivering payloads like DEV#POPPER and OmniStealer, with the potential to distribute additional malware.
AI summary of the linked source. Not reviewed by an editor. How this works
Run DEV#POPPER?
Get an email when a new story names DEV#POPPER, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe PolinRider campaign demonstrates how sophisticated threat actors can weaponize trusted open source ecosystems by compromising maintainer accounts and rewriting Git history to inject malicious code into legitimate repositories. Because developers inherently trust packages from established maintainers, malicious payloads hidden as font files or configuration entries can propagate widely before detection. The delivery of stealers and remote-access malware like OmniStealer and DEV#POPPER means downstream consumers of infected packages risk full credential and data compromise. This campaign highlights that supply chain integrity is now a frontline security concern, not just a peripheral risk. Organizations that blindly consume open source dependencies without integrity checks are effectively outsourcing their attack surface to threat actors.
What helps against this
How we list vendors- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- url — https://socket.dev/supply-chain-attacks/polinrider