The PolinRider attack no longer looks like a point story about malicious npm packages. Socket researchers found 162 malicious release artifacts in 108 packages and extensions, and the campaign’s footprints are now leading to multiple open source ecosystems, including npm, Packagist, Go modules and Chrome extensions. Activity is associated with the North Korean cluster Contagious Interview, also known as Famous Chollima.
The main goal of the campaign has not changed. Attackers hit developers because the programmer’s working machine often stores access repositories, package registries, clouds, CI/CD and internal services. One infected package can open the way not only to the victim’s laptop, but also to the supply chain through which the code will get to other users.
According to Socket, PolinRider went beyond ndPM and affected 80 Go-modules, 10 Packagist packages and one Chrome extension. The researchers consider the campaign active and expect new infected packages to appear, as attackers continue to hack into the content accounts, change legitimate repositories and publish infected versions where they get access to the registries.
The technique of attack is built around one reception. The hackers add a confusing JavaScript downloader to normal projects and then hide malicious code so that the runaway view of the repository does not show anything. In older versions, the PolinRider code was often masked in configuration files, including config.js, vite.config.js and similar files. In new cases, the loader is hidden in fake .woff2 files that look like ordinary fonts.
The launch of malicious code is also disguised as the normal operation of the developer’s tools. In one of the options file .vscode/tasks.json contains a hidden task that starts when the folder is opened in the VS Code and runs a fake font file through Node.js. The developer can open the project for verification or refinement and itself run the malicious chain without installing a separate program.
Socket also describes cases where attackers rewrote the story of Git. Force push and retroactively-specific commits helped make malicious changes similar to old and harmless edits. The usual GitHub page in such a situation may look clean, and the signs of hacking remain in the activity log, metadata releases and suspicious configuration changes.
One notable example is Xpos587 account. Several repositories under this account were changed in a narrow time window on June 23 at 10:00 UTC. Socket considers such a synchronous surge atypical for the usual work of the container and connects the picture with the compromise of the account. After the repository changes, the malicious versions of the affected Go-modules got into the package ecosystem.
Another campaign line touched on Packagist and namespace sevenspan, associated with the GitHub-organization of 7span. Maintainers found some of the infection and removed the fake .woff2 files, but the cleaning did not close all the traces. In some repositories there is a confusing JavaScript hidden in configuration files. This case shows the risk of a partial reaction when the team removes one method of disguise, but misses the other.
After unpacking, the PolinRider downloader turns to the blockchain infrastructure and public RPC services, including TRON, Aptos and BNB Smart Chain, receives an encrypted second stage, decrypts data with built-in XOR keys and starts the result through eval(). Among the already seen useful loads, Socket calls DEV#POPPER and OmniStealer. Such tools can steal credentials, browser data, crypto wallets and execute commands, but the download scheme itself allows you to replace the payload in future attacks.
For teams that have put affected versions of packages or extensions, Socket advises to consider the work environment potentially compromised before verification. Developers need to look for suspicious VS Code tasks with starting when opening a folder, commands that execute files with atypical extensions, unexpected edits .vscode/tasks.json, vite.config.js, eslint.config.js, configuration files and directories with static resources. Secrets npm, GitHub, PyPI, RubyGems, clouds, CI/CD, SSH, Kubernetes, Docker, Vault and other services are safer to change from a clean car, not a host where the infected package could be launched.
PolinRider is dangerous not only by the number of artifacts found. The campaign shows how fragile the trusted chain has become around the open source. The developer sees a familiar repository, a normal history of comets and the usual configs, but behind such a showcase may hide the bootloader, which is included at the time of the project opening.
The main goal of the campaign has not changed. Attackers hit developers because the programmer’s working machine often stores access repositories, package registries, clouds, CI/CD and internal services. One infected package can open the way not only to the victim’s laptop, but also to the supply chain through which the code will get to other users.
According to Socket, PolinRider went beyond ndPM and affected 80 Go-modules, 10 Packagist packages and one Chrome extension. The researchers consider the campaign active and expect new infected packages to appear, as attackers continue to hack into the content accounts, change legitimate repositories and publish infected versions where they get access to the registries.
The technique of attack is built around one reception. The hackers add a confusing JavaScript downloader to normal projects and then hide malicious code so that the runaway view of the repository does not show anything. In older versions, the PolinRider code was often masked in configuration files, including config.js, vite.config.js and similar files. In new cases, the loader is hidden in fake .woff2 files that look like ordinary fonts.
The launch of malicious code is also disguised as the normal operation of the developer’s tools. In one of the options file .vscode/tasks.json contains a hidden task that starts when the folder is opened in the VS Code and runs a fake font file through Node.js. The developer can open the project for verification or refinement and itself run the malicious chain without installing a separate program.
Socket also describes cases where attackers rewrote the story of Git. Force push and retroactively-specific commits helped make malicious changes similar to old and harmless edits. The usual GitHub page in such a situation may look clean, and the signs of hacking remain in the activity log, metadata releases and suspicious configuration changes.
One notable example is Xpos587 account. Several repositories under this account were changed in a narrow time window on June 23 at 10:00 UTC. Socket considers such a synchronous surge atypical for the usual work of the container and connects the picture with the compromise of the account. After the repository changes, the malicious versions of the affected Go-modules got into the package ecosystem.
Another campaign line touched on Packagist and namespace sevenspan, associated with the GitHub-organization of 7span. Maintainers found some of the infection and removed the fake .woff2 files, but the cleaning did not close all the traces. In some repositories there is a confusing JavaScript hidden in configuration files. This case shows the risk of a partial reaction when the team removes one method of disguise, but misses the other.
After unpacking, the PolinRider downloader turns to the blockchain infrastructure and public RPC services, including TRON, Aptos and BNB Smart Chain, receives an encrypted second stage, decrypts data with built-in XOR keys and starts the result through eval(). Among the already seen useful loads, Socket calls DEV#POPPER and OmniStealer. Such tools can steal credentials, browser data, crypto wallets and execute commands, but the download scheme itself allows you to replace the payload in future attacks.
For teams that have put affected versions of packages or extensions, Socket advises to consider the work environment potentially compromised before verification. Developers need to look for suspicious VS Code tasks with starting when opening a folder, commands that execute files with atypical extensions, unexpected edits .vscode/tasks.json, vite.config.js, eslint.config.js, configuration files and directories with static resources. Secrets npm, GitHub, PyPI, RubyGems, clouds, CI/CD, SSH, Kubernetes, Docker, Vault and other services are safer to change from a clean car, not a host where the infected package could be launched.
PolinRider is dangerous not only by the number of artifacts found. The campaign shows how fragile the trusted chain has become around the open source. The developer sees a familiar repository, a normal history of comets and the usual configs, but behind such a showcase may hide the bootloader, which is included at the time of the project opening.
