PolinRider: North Korea floods npm with 108 packages

A group linked to North Korea is actively hacking the open source supply chain.

108 malicious packages, 4 ecosystems

The PolinRider campaign, attributed to a North Korea-linked actor, flooded 108 malicious packages across four ecosystems: npm, Packagist, Go modules and the Chrome Web Store. 162 malicious artifacts in total.

The pattern is well-oiled. It follows March 2026's Axios attack (where the world's most-downloaded npm package — 100M downloads/week — was compromised for 3 hours by the UNC1069 group).

Git rewriting, typosquatting, compromised maintainers

This time, the technique evolves. The attackers use:

• Git history rewriting (force pushes, backdated commits) to make malicious changes look older and less suspicious
• Typosquatted packages AND compromises of legitimate maintainer accounts
• Code that extracts credentials from development environments and enables remote access

The group behind PolinRider is tied to the "Contagious Interview" campaign — an operation specifically targeting developers and security researchers. The goal: reach build environments, CI/CD pipelines and infrastructure secrets.

Countermeasures for DevSecOps teams

For DevOps and DevSecOps teams:

• Scan your lockfiles (package-lock.json, go.sum, composer.lock) with Socket, Snyk or Phaseless
• Verify commit integrity on critical repos (signed commits mandatory)
• Segment your CI/CD runners — a compromised runner must not be able to reach production
• Watch environment variables exposed in your containers (the Podman CVE 2026-57231 showed a malicious container could exfiltrate all host env vars)

The open source supply chain has become a playground for state-backed groups. 108 packages, 4 ecosystems, a single group — and that is only what was found. The real attack surface is probably wider.