North Korean Hackers Hijack 108 Packages Across npm, Go and Chrome in Sprawling PolinRider Campaign
North Korean threat actors linked to the Contagious Interview campaign have published 108 malicious packages and browser extensions across npm, Packagist, Go, and Google Chrome as part of an ongoing operation called PolinRider, which has compromised nearly 2,000 public GitHub repositories. The attackers use obfuscated JavaScript payloads, fake font files, and VS Code task files to deliver malware including BeaverTail, DEV#POPPER RAT, and OmniStealer, while rewriting Git history to make malicious changes appear legitimate and harder to detect. Developers are advised to treat any affected environments as fully compromised, rotate secrets, rebuild from clean lockfiles, and audit repositories for suspicious modifications to configuration files.