North Korean Hackers Poison Open Source Packages in Ongoing Supply Chain Attack

North Korea-linked hackers target open source software in PolinRider, using GitHub to spread malware. Developers, check for potential breaches!

By Content Team

Jul 6, 2026

ON THIS PAGE

Researchers at Socket have tracked a North Korea-linked campaign quietly compromising open source software since December 2025, which they've named PolinRider. It sits under the broader Contagious Interview operation.

The attackers hijack legitimate GitHub maintainer accounts, inject obfuscated JavaScript loaders into real repositories, and use Git history rewriting to make the changes look old. The loaders pull encrypted payloads from blockchain and public RPC infrastructure, which makes the delivery channel hard to take down. Two payloads follow: the DEV#POPPER RAT and OmniStealer.

So far, 162 malicious artifacts across 108 packages have been found on NPM, Packagist, Go modules and Chrome extensions. Any developer who installed an affected package should assume their environment is compromised — and because credentials may already be exposed, remediate from a clean machine rather than the infected host.

Source: SecurityWeek

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?