North Korean Hackers Hijack 108 Packages Across npm, Go and Chrome in Sprawling PolinRider Campaign
North Korea's Contagious Interview threat group has been busy. Researchers at Socket have identified 108 malicious packages and browser extensions planted across npm, Packagist, Go modules, and the Chrome Web Store as part of a campaign now being tracked as PolinRider. Across 162 release artifacts, the breakdown includes 19 npm libraries, 10 Composer packages, 61 Go modules, and a single Chrome extension.
Contagious Interview has been running since at least 2023. The playbook is well-established: operators pose as recruiters or technical collaborators on LinkedIn, GitHub, and freelance platforms, build credibility through fake companies staffed with AI-generated employee profiles, and then lure developers into executing malicious code under the guise of job assessments.
PolinRider was first spotted by the OpenSourceMalware team in March 2026. At the time, researchers found obfuscated JavaScript payloads being silently injected into hundreds of public GitHub repositories, delivering a new variant of BeaverTail, a JavaScript-based malware family long associated with this group. By April 11, the campaign had spread to 1,951 public repositories across 1,047 separate owners.
It has since merged with a related cluster called TaskJacker, which drops malicious VS Code task files into developers' existing repositories. These tasks use the "runOn: 'folderOpen'" option, meaning arbitrary code executes the moment a developer opens the folder as a workspace in VS Code or Cursor. No suspicious prompts. No obvious red flags.
Critically, the attackers are not using stolen GitHub credentials to get in. Victims are compromised first, most likely through a malicious VS Code extension or npm package. Once a maintainer account is under their control, possibly via expired domain takeover or an account recovery exploit, the attackers modify legitimate repositories and publish infected versions.
The malware itself searches for common JavaScript config files, things like postcss.config.mjs, tailwind.config.js, and next.config.mjs, and appends malicious code to whatever it finds. A Windows batch script then quietly rewrites the last commit to make the change appear authored by the legitimate account holder. Similar history-rewriting tools are suspected to exist for Linux and macOS.
The second-stage payload is fetched via blockchain infrastructure, specifically TRON, Aptos, and BNB Smart Chain, which provides a degree of resilience against traditional takedowns. What unpacks from that encrypted payload is DEV#POPPER RAT combined with OmniStealer, a combination documented by eSentire back in March 2026.
Socket researcher Karlo Zanki flagged an uncomfortable implication for defenders: because the attackers are force-pushing commits and backdating them, the visible commit history on GitHub is not a reliable indicator of whether a repository is clean. Defenders need to go deeper, checking repository activity logs, package release metadata, VS Code task configurations, and any suspicious modifications to config files.
This sits alongside separate findings from JFrog, which identified another cluster of Contagious Interview-linked npm packages masquerading as Rollup polyfill tools. There are clear tactical overlaps between PolinRider, TaskJacker, and a third cluster known as Fake Font, suggesting coordinated or at minimum parallel operations under the same umbrella.
If you have installed any of the flagged packages, the advice is straightforward and unpleasant: treat the entire environment as compromised. Rotate any exposed credentials from a clean machine, rebuild from a known-good lockfile, and audit developer workstations for hidden execution paths or tampered files including .vscode/tasks.json, config.js, vite.config.js, and eslint.config.js. The campaign is still active, and new packages are expected to keep appearing.