[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fSZJ3g3u8lDuTSZAd2AOWup0Ielza4Be3PhqWo286IDQ":3},{"article":4,"iocs":57,"watch_terms":80,"solutions":81,"lesson":174},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":34,"category":35,"article_tags":39},"ced4cb38-9c82-4a34-b0f1-8b6821f0504b","PolinRider Spreads Through Compromised GitHub Accounts and Packagist","polinrider-spreads-through-compromised-github-accounts-and-packagist-faa3d2","Socket researchers identified malicious code in the dev-main version of visanduma\u002Fnova-two-factor, a Packagist package with more than 700,000 cumulative downloads, as the PolinRider campaign continues to spread through compromised developer accounts and Git repositories. The Socket Threat Research Team continues to track malicious activity associated with PolinRider. In our July research post, we provided initial technical details about this persistent campaign, which distributes malware across npm, PyPI, Go modules, Packagist, and Chrome extensions. We also documented its expansion into the Packagist ecosystem. Among the latest affected projects is visanduma\u002Fnova-two-factor, a Packagist package with more than 700,000 cumulative downloads. The malicious code is present in the unstable dev-* versions; no stable malicious release has been identified at the time of writing. This distinction limits conclusions about exposure through normal stable package installation, but users consuming the development branches directly may be affected. Analysis of the Visanduma GitHub organization indicates that its repositories have been compromised since mid-June 2026. The malicious changes were introduced through the LaHiRu developer account. Public contribution activity shows hundreds of contributions to private repositories after the account was compromised, preventing researchers from determining the campaign’s full repository-level reach. The activity reinforces a defining characteristic of PolinRider: package-registry compromise is often a consequence of a broader Git-based intrusion rather than the campaign’s primary objective. The operators use ordinary source-code collaboration to reach developer environments, spread into additional repositories, and maintain access over time. Git-Based Infection and Persistence # PolinRider is designed to blend into routine development activity. The operators compromise developer accounts, insert malicious content into source repositories, and use common actions—cloning a repository, opening it in an integrated development environment (IDE), or running a normal build or test—to begin the infection chain. The campaign repeatedly uses four techniques: Git history rewriting. Operators force-push rewritten history to introduce or replace malicious code while making review and recovery more difficult. Payload concealment. Malicious JavaScript is hidden in configuration files or files presented as .woff2 fonts, locations developers are less likely to inspect during code review. Automatic execution. Patched configuration files execute during build activity. Other samples use \"runOn\": \"folderOpen\" in .vscode\u002Ftasks.json, triggering code when a developer opens the repository in a VS Code–compatible IDE. Staged payload delivery. The initial code resolves C2 infrastructure through a dead-drop mechanism, using techniques including EtherHiding and, more recently, NullReceiver. It then downloads later-stage infostealer payloads from the resolved servers. Repeated force-pushes visible in affected repository activity are consistent with the campaign’s use of history rewriting. This continued activity indicates that new malware variations are being delivered to repositories that are already compromised. Because the same account also interacted with private repositories, public GitHub data provides only a partial view of the intrusion. # PHP projects have been recurring targets of PolinRider, but earlier infections generally crossed ecosystem boundaries by planting malicious JavaScript in project configuration files. Socket researchers recently identified a variation in which heavily obfuscated JavaScript was inserted directly into index.php and executed through PHP’s shell_exec function. This technique allows a PHP entry point to launch the JavaScript infection chain directly. Its appearance suggests that the operators adapt execution methods to the opportunities available in each compromised project rather than relying on one fixed delivery path. Why Package Registries Are a Secondary Spread Channel # Many software supply-chain attacks prioritize rapid distribution: compromise a popular package, publish a malicious version, and reach as many downstream users as possible before defenders respond. PolinRider follows a slower model. The campaign’s primary spread channel is developer collaboration in Git-based services. Compromised source repositories give the operators opportunities to infect contributors, access private projects, and propagate through normal development workflows. Package publication becomes an additional distribution path when a compromised repository produces a new release. Go modules and Packagist can resolve code directly from Git repositories. That behavior allows malicious source code already planted in a repository to become available through another ecosystem without requiring the operators to steal registry publishing credentials or tokens. The visanduma\u002Fnova-two-factor compromise fits this pattern. Malicious code is present on dev-main, but no stable malicious version has been released at the time of writing. The operators appear willing to maintain access and wait for routine developer or release activity to carry the payload forward. Impact # The campaign’s complete impact remains difficult to measure. GitHub code search reflects current public repository state and therefore misses at least three important categories: Private repositories touched by compromised accounts. Repositories that were infected and later cleaned. Developer systems on which malicious code executed before repository cleanup. Cleaning the source repository also does not establish that affected workstations or CI environments are clean. Once a later-stage payload executes, the host may remain compromised independently of the repository. Public reports from affected developers describe difficulty removing later-stage components, consistent with the campaign’s persistent design. The campaign’s apparent primary objective remains cryptocurrency theft. The broader information-stealing capabilities of the delivered malware may also expose credentials, source code, and other data useful to the operators. Immediate Guidance # Avoid the affected development branch. Do not install or resolve visanduma\u002Fnova-two-factor from dev-main until the repository is confirmed clean. Pin dependencies to a reviewed, known-good commit or stable release according to organizational policy. Audit repository history, not only the current tree. Review force-push events, branch-protection changes, reflogs, workflow changes, and commits from compromised or unfamiliar accounts. Inspect automatic execution paths. Search for unexpected .vscode\u002Ftasks.json entries, especially \"runOn\": \"folderOpen\"; modified build or test configuration; executable content in .woff2 files; and shell_exec calls that launch Node.js or decoded commands. Treat execution as a host compromise. If a developer opened an affected repository or ran its build or test workflow, isolate and investigate the workstation. Rebuild from a known-good state. Repository cleanup alone is insufficient after payload execution. Reimage affected developer systems where investigation cannot establish integrity. Rotate accessible credentials. Revoke and replace GitHub tokens, package-registry credentials, cloud keys, cryptocurrency wallet secrets, SSH keys, and other credentials available to affected users or processes. Harden Git and IDE workflows. Enforce branch protection, restrict force-pushes, require review for workflow and editor-configuration changes, and prevent untrusted repository tasks from running automatically. Review account activity. Investigate access tokens, sessions, commits, repository creation, collaborator changes, and private-repository activity associated with affected developer identities. # PolinRider’s persistence comes from its integration with ordinary development activity. The campaign does not depend on one package, one registry, or one short-lived payload. It uses Git-hosted collaboration as both its foothold and its distribution mechanism, while adapting execution techniques to individual projects. The latest Packagist finding demonstrates why defenders should not measure this campaign solely by visible malicious package releases or current public-code search results. Its reach includes source history, private repositories, developer identities, and endpoints that may remain infected after the public code has been cleaned. A major disruption of the North Korea-linked operators associated with this campaign appears unlikely in the near term. PolinRider is therefore unlikely to disappear. Instead, the campaign will likely continue to evolve and adopt increasingly sophisticated techniques. Socket’s Threat Research Team will continue monitoring PolinRider and will update the indicators and affected-project scope as additional evidence becomes available. Indicators of Compromise # Malicious Packagist package versions visanduma\u002Fnova-two-factor@dev-nova4support visanduma\u002Fnova-two-factor@dev-main visanduma\u002Fnova-two-factor@dev-using-inertia visanduma\u002Fnova-two-factor@dev-nova5 Dead-Drop Resolver Ethereum Sender Address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a Resolved C2 IP Addresses 193[.]247[.]144[.]38 166[.]88[.]73[.]46 166[.]88[.]134[.]62 23[.]27[.]13[.]135 Payload Files 7d47c430e6e404dc2fa8b4837678d1cbdb4d0aeacec9b405655cab79d54a2ad9 - tailwind.config.js b7ede935d4979146b55f12b9eec7c83b61962b478f5dc9b8db251e539ec2abd3 - tailwind.config.js ccb187dc9de0cc7477c9817ae53365d273e121407c0305f863e2ab67c35d6395 - tailwind.config.js 139ea03dcddf4aa810d55740be3cf6c92ce7a9f3cbcbbb35440e25b769a87683 - tailwind.config.js 515a53291d25d229e1f9fa72e66407e1cfd7e77c91478400b24d5185af68531a - tailwind.config.js","The PolinRider campaign has expanded to compromise developer accounts on GitHub, leading to the injection of malicious code into the development branches of the Packagist package visanduma\u002Fnova-two-factor. This package has over 700,000 cumulative downloads. The attackers leverage Git-based intrusions, including history rewriting and payload concealment, to spread malware and maintain persistence, often targeting PHP projects. The campaign's primary objective appears to be cryptocurrency theft, with broader information-stealing capabilities also present.","PolinRider campaign exploits compromised GitHub accounts to inject malware into Packagist packages.","https:\u002F\u002Fsocket.dev\u002Fblog\u002Fpolinrider-github-packagist?utm_medium=feed","https:\u002F\u002Fcdn.sanity.io\u002Fimages\u002Fcgdhsj6q\u002Fproduction\u002Fc2f3e264f314ea654c75609b2e5efcadef4ef7d4-1672x941.png?w=1000&q=95&fit=max&auto=format","2026-09-17T15:33:22.86+00:00","2026-09-17T18:00:32.288219+00:00",9,[17,20,23,26,28,31],{"name":18,"type":19},"PolinRider","campaign",{"name":21,"type":22},"nova-two-factor","product",{"name":24,"type":25},"Packagist","vendor",{"name":27,"type":25},"GitHub",{"name":29,"type":30},"Git","technology",{"name":32,"type":33},"LaHiRu","threat_actor","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":34,"icon":36,"name":37,"slug":38},null,"Supply Chain","supply-chain",[40,42,47,52],{"category":41},{"id":34,"icon":36,"name":37,"slug":38},{"category":43},{"id":44,"icon":36,"name":45,"slug":46},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":48},{"id":49,"icon":36,"name":50,"slug":51},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":53},{"id":54,"icon":36,"name":55,"slug":56},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[58,62,64,66,68,72,74,76,78],{"type":59,"value":60,"context":61},"ip","193.247.144.38","Resolved C2 IP Address",{"type":59,"value":63,"context":61},"166.88.73.46",{"type":59,"value":65,"context":61},"166.88.134.62",{"type":59,"value":67,"context":61},"23.27.13.135",{"type":69,"value":70,"context":71},"hash_sha256","7d47c430e6e404dc2fa8b4837678d1cbdb4d0aeacec9b405655cab79d54a2ad9","Payload file: tailwind.config.js",{"type":69,"value":73,"context":71},"b7ede935d4979146b55f12b9eec7c83b61962b478f5dc9b8db251e539ec2abd3",{"type":69,"value":75,"context":71},"ccb187dc9de0cc7477c9817ae53365d273e121407c0305f863e2ab67c35d6395",{"type":69,"value":77,"context":71},"139ea03dcddf4aa810d55740be3cf6c92ce7a9f3cbcbbb35440e25b769a87683",{"type":69,"value":79,"context":71},"515a53291d25d229e1f9fa72e66407e1cfd7e77c91478400b24d5185af68531a",[24,27,21],{"controls":82,"vendors":167},[83,112,141],{"slug":84,"name":85,"problem":86,"products":87},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[88,96,104],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":113,"name":114,"problem":115,"products":116},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[117,125,133],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"slug":142,"name":143,"problem":144,"products":145},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[146,154,162],{"vendor_slug":147,"vendor_name":148,"vendor_logo":149,"product_slug":150,"product_name":151,"url":152,"description":153},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":155,"vendor_name":156,"vendor_logo":157,"product_slug":158,"product_name":159,"url":160,"description":161},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":147,"vendor_name":148,"vendor_logo":149,"product_slug":163,"product_name":164,"url":165,"description":166},"jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",[168],{"slug":169,"name":170,"logo_path":171,"roles":172},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png",[173],"reported_by",{"slug":175,"title":176,"body":177,"framework_refs":178,"framework_notes":189},"malicious-code-injected-into-popular-php-package-via-compromised-github-accounts","Malicious Code Injected into Popular PHP Package via Compromised GitHub Accounts","The PolinRider campaign demonstrates a classic software supply chain attack: adversaries compromised developer accounts on GitHub and used that access to inject malicious payloads into a widely-used PHP package (visanduma\u002Fnova-two-factor) with over 700,000 cumulative downloads. By rewriting Git history and concealing payloads within development branches, attackers ensured that downstream consumers unknowingly pulled compromised code into their own projects. This matters because developers inherently trust packages from established repositories like Packagist, making supply chain poisoning an extremely high-leverage attack vector. The campaign's goals — cryptocurrency theft and credential harvesting — show that even niche open-source packages can become a gateway to serious financial and data loss across thousands of dependent organizations.",[179,180,181,182,183,184,185,186,187,188],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 6: Access Control Management","CIS Control 16: Application Software Security","NIST SP 800-161: Cybersecurity Supply Chain Risk Management","NIST AC-2: Account Management","NIST SA-12: Supply Chain Protection","NIST SR-11: Component Authenticity","SLSA Supply Chain Security Framework (Levels 1-4)","OWASP Top 10 A06:2021 – Vulnerable and Outdated Components","GDPR Article 32: Security of Processing (for EU-based organizations storing user data in affected systems)",{"NIST AC-2: Account Management":190,"NIST SR-11: Component Authenticity":191,"NIST SA-12: Supply Chain Protection":192,"CIS Control 6: Access Control Management":193,"CIS Control 16: Application Software Security":194,"SLSA Supply Chain Security Framework (Levels 1-4)":195,"CIS Control 2: Inventory and Control of Software Assets":196,"NIST SP 800-161: Cybersecurity Supply Chain Risk Management":197,"OWASP Top 10 A06:2021 – Vulnerable and Outdated Components":198,"GDPR Article 32: Security of Processing (for EU-based organizations storing user data in affected systems)":199},"Account management for developer accounts, including MFA and monitoring, protects against account takeover.","Verifying component authenticity helps detect packages whose history has been rewritten to hide malicious code.","Supply chain protection includes checking the integrity of packages before use.","Strong access controls, including MFA on developer accounts, would make it harder to compromise GitHub accounts.","Secure development practices include verifying dependencies and reviewing changes before adopting new package versions.","SLSA provenance requirements help detect tampered builds and source changes in packages like this.","An inventory of software dependencies helps teams find projects using the compromised nova-two-factor package.","Supply chain risk management covers open-source packages like nova-two-factor that attackers can poison.","Compromised components are a dependency risk similar to outdated ones, so tracking and verifying dependencies matters.","Where affected systems store personal data, protecting against supply chain compromise is part of appropriate security."]