supply chain North Korea open source malware NPM

North Korean Hackers Are Quietly Poisoning Open Source Repositories

12 July 2026

North Korean hackers are conducting a supply chain campaign called PolinRider, active since December 2025, targeting open source developers across NPM, Packagist, Go modules, and Chrome extensions. The attackers compromise maintainer accounts to inject obfuscated JavaScript loaders into legitimate repositories, which deliver the DEV#POPPER RAT and OmniStealer malware, with 162 malicious artifacts identified across 108 packages so far. Security firm Socket warns that any developers who installed affected packages should treat their environment as potentially compromised and conduct remediation from a clean machine, as credentials for package registries, cloud services, and CI/CD pipelines may have been exposed.

A supply chain campaign targeting open source developers has been traced back to North Korean threat actors, with researchers at Socket tracking what they're calling PolinRider. It's been running since at least December 2025, and the scope is broader than most people will have noticed.

The campaign works by compromising the GitHub accounts of legitimate package maintainers, injecting obfuscated JavaScript loaders into real repositories, then pushing the infected versions out to developers who have no reason to suspect anything is wrong. The payloads delivered are DEV#POPPER, a remote access trojan, and OmniStealer, which does exactly what it sounds like.

PolinRider sits under the umbrella of Contagious Interview, a North Korean operation that has surfaced under various names including DeceptiveDevelopment, Operation Dream Job, and ClickFake Interview. The common thread across all of them is targeting developers specifically, because developers are the fastest route to high-value infrastructure.

Socket has so far identified 162 malicious release artifacts spread across 108 distinct packages. The campaign isn't limited to NPM either. It has spread to Packagist, Go modules, and Chrome extensions. On Packagist, packages under the sevenspan namespace were hit, with the malicious loaders stashed inside configuration files that survived the initial cleanup.

One particularly cynical trick being used here is Git history rewriting, which makes the malicious commits appear older than they are. If you're doing a quick audit and the suspicious code looks like it's been sitting there untouched for months, you're more likely to overlook it. That's the point.

The loaders themselves connect out to blockchain and public RPC infrastructure to retrieve encrypted payloads. Using decentralised infrastructure makes the command-and-control setup harder to block or take down cleanly.

Socket's researchers flagged the compromise of a GitHub account called Xpos587, which maintains several repositories that were all modified within a short window on June 23.

If you installed any affected package or extension during the campaign window, Socket's advice is blunt: assume the environment is compromised. More importantly, don't attempt remediation from the potentially infected machine. The attackers are specifically after package registry credentials, cloud access keys, source code, and CI/CD secrets. Cleaning up from a poisoned host just hands them more time on the clock.

READ NEXT

North Korean Hackers Hijack 108 Packages Across npm, Go and Chrome in Sprawling PolinRider Campaign Iran's MOIS-Linked Hackers Deploy Modular C2 Framework Against Israeli Targets Supply Chain Attack Hits Packagist: Eight PHP Packages Compromised via GitHub-Delivered Malware