PolinRider — North Korea-Linked Open-Source Supply-Chain Campaign

PolinRider is a North Korea-linked open-source supply-chain campaign tracked by the Socket Threat Research Team and attributed to the broader Famous Chollima / Contagious Interview activity cluster. Active since December 2025 and still expanding into July 2026, Socket identified 162 malicious release artifacts across 108 packages and extensions spanning four ecosystems — npm, Packagist (PHP), Go modules (80 compromised modules), and one Chrome extension. The operators compromise legitimate maintainer accounts and GitHub repositories, then plant obfuscated JavaScript loaders and publish trojanized versions downstream.

The signature tradecraft is developer-workstation auto-execution. Malicious JS is appended into legitimate config files — vite.config.js, eslint.config.js, and other *config.js — so it runs the next time the project builds or lints, and injected .vscode/tasks.json entries with "runOn": "folderOpen" auto-execute a fake .woff2 font file via Node.js the moment a developer opens the folder in VS Code. The loader reaches out to public blockchain RPC infrastructure (TRON, Aptos, BNB Smart Chain) used as a dead-drop resolver, retrieves an encrypted second stage, XOR-decrypts it with embedded keys and executes it with eval(). Follow-on payloads are the DEV#POPPER RAT (command execution, socket.io-based C2) and the OmniStealer information stealer (credential, browser-data and crypto-wallet theft). Operators cover their tracks by rewriting git history via force pushes with anti-dated commits and hiding code with whitespace padding beyond the default screen width.

This is a distinct named campaign from the previously-packaged BeaverTail / Contagious Interview interview-lure activity, though it shares the same DPRK cluster and the "developer as patient-zero" objective. The blast radius is any developer endpoint, CI runner, or container build host that installed an affected package, cloned a poisoned repo, or opened one in VS Code.

Defender priority: The highest-fidelity catch is a node process executing a .woff2 font file, or VS Code (Code/code) spawning node/a shell on folder open. Pair with a dev-context process resolving a blockchain RPC domain and a secondary detached interpreter. Sweep every dev repo and build agent for the PolinRider artifacts (.vscode/tasks.json folderOpen tasks, fake .woff2 files, and the named repos/packages in §4/§10), and treat any hit as a credential-compromise event — rotate developer secrets and wallets.

Hunter note: The abused blockchain RPC endpoints are legitimate public infrastructure (TRON/Aptos/BNB) used as dead-drop resolvers — they are NOT attacker-owned IOCs, so Q3 is a behavioral hunt with expected FPs on genuine web3 developers, not a blocklist. Atomic file hashes and stage-2 C2 IPs for DEV#POPPER / OmniStealer were not broadly published at pack time — behavioral detection is primary; the IOC CSV uses REPLACE_WITH placeholders for hashes so no fabricated indicator ships. The named repos/accounts (Xpos587, 7span/sevenspan) are sample compromised identities from Socket, not an exhaustive list — pivot on Socket's live tracker for the full package inventory.

Hunt Hypotheses (fidelity-ordered)

1. H1 (high): A node process executes a .woff2 file — a font asset should never be a Node.js entry point. low FP
2. H2 (medium): VS Code (Code/code) spawns node or a shell immediately on folder open — the runOn:folderOpen task trigger. med FP
3. H3 (medium): A dev-tool-context process (node/Code/npm) resolves a public blockchain RPC domain (TRON/Aptos/BNB) — loader dead-drop fetch. med/high FP
4. H4 (medium): A node process spawns a secondary interpreter/shell child — decoded stage-2 execution after eval(). med FP
5. H5 (medium): A node/editor-context process makes a long-lived outbound connection to a non-RFC1918 raw IP — socket.io DEV#POPPER C2 / OmniStealer exfil. med FP
6. H6 (medium): PolinRider artifacts on disk — a .vscode/tasks.json with a folderOpen task, a fake .woff2, or the named compromised packages/repos. med FP
7. H7 (medium): A dev-context process reads a browser credential store or crypto-wallet directory — OmniStealer collection. med FP

Attack Chain

Repo / project sweep for PolinRider auto-run artifacts (dev endpoints + agents)

# VS Code folderOpen auto-run tasks (the auto-execution trigger)
grep -rln "folderOpen" --include=tasks.json .
# Fake font files that are actually JS entry points
find . -type f -name "*.woff2" -exec sh -c 'head -c 4 "$1" | grep -qv "wOF2" && echo "SUSPECT: $1"' _ {} \;
# Malicious JS appended into config files (look for eval / long whitespace-padded lines)
grep -rEln "eval\(|Buffer\.from\(.*base64|fromCharCode" --include=*config.js .

Named compromised packages / repos (SCA + git remotes)

# npm / Packagist / Go dependency trees
npm ls 2>/dev/null | grep -Ei "git2md|markfetch|react-list"
grep -rEln "Xpos587/(git2md|markfetch)|Artiffusion-Inc/mirofish|7span/react-list|sevenspan/" .
# Go module cache
grep -rEln "git2md|markfetch|mirofish" "$(go env GOPATH 2>/dev/null)/pkg/mod" 2>/dev/null

Blockchain RPC dead-drop egress from dev tooling (proxy/DNS logs)

# In your web-proxy / DNS log platform, look for build/editor hosts resolving:
#   *.trongrid.io  *.aptoslabs.com  bsc-dataseed*  *.bnbchain.org
# from a node/Code/npm process context outside your known web3 dev group.

Note: Because operators rewrite git history with anti-dated force pushes, a clean-looking commit log does NOT clear a repo — audit branch-protection/force-push events server-side (GitHub audit log) and pivot on the endpoint process/network telemetry (Q1–Q5).

Promotion path: Q1 is a strong IOA/Prevent candidate (near-zero FP, attacker-specific). Q2 is a good Detect after per-environment baselining. Q3–Q7 remain Investigate-only hunt queries until FP-baselined, and are strongest when correlated on the same aid.

1 · Enforce VS Code Workspace Trust + disable auto-tasks (settings.json)

// User settings.json — block untrusted-folder auto execution
{
  "security.workspace.trust.enabled": true,
  "security.workspace.trust.untrustedFiles": "prompt",
  "task.allowAutomaticTasks": "off"
}
// Fleet-manage via MDM / GPO by deploying this to each user's settings.json

2 · Sweep & flag PolinRider artifacts (bash)

#!/usr/bin/env bash
set -euo pipefail
ROOT="${1:-$HOME}"
echo "[*] folderOpen auto-run tasks:"
grep -rln "folderOpen" --include=tasks.json "$ROOT" || true
echo "[*] .woff2 files that are NOT real fonts (bad magic):"
find "$ROOT" -type f -name "*.woff2" -exec sh -c \
  'head -c 4 "$1" | grep -qv "wOF2" && echo "  SUSPECT: $1"' _ {} \; 2>/dev/null || true
echo "[*] eval/base64 loaders appended into config files:"
grep -rEln "eval\(|Buffer\.from\([^)]*base64|fromCharCode" --include=*config.js "$ROOT" || true
echo "[*] named compromised repos/packages:"
grep -rEln "Xpos587/(git2md|markfetch)|Artiffusion-Inc/mirofish|7span/react-list|sevenspan/" "$ROOT" || true

3 · CI hardening (pipeline YAML fragment)

# Never run lifecycle scripts on untrusted installs
npm ci --ignore-scripts
pnpm config set enable-pre-post-scripts false
yarn config set enableScripts false
# Deny build-agent egress except to the registry/mirror allowlist

4 · Falcon RTR triage one-liner (macOS/Linux dev host)

find "$HOME" -maxdepth 6 -path "*/.vscode/tasks.json" -exec grep -l "folderOpen" {} \; 2>/dev/null
# Windows (PowerShell)
Get-ChildItem $env:USERPROFILE -Recurse -Filter tasks.json -EA SilentlyContinue |
  Select-String -Pattern 'folderOpen' | Select-Object Path

Behavioral coverage of the auto-run→fetch→exec chain is strong at the front (Q1/Q2) and correlative in the middle (Q3–Q5). Gaps are registry/VCS-side takeover (needs SCA/SBOM + GitHub audit) and stage-2 atomic indicators (await published hashes/C2 — see CSV placeholders). Validate §11 gates before promoting Q1 to Prevent.