North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign

North Korean threat actors linked to the Contagious Interview campaign have published 108 unique malicious packages and browser extensions across npm, Packagist, Go, and Google Chrome as part of an ongoing activity called PolinRider. The campaign remains active, with new malicious packages likely to appear as threat actors compromise maintainer accounts and modify legitimate repositories.

According to Socket security researcher Karlo Zanki, the 162 malicious release artifacts span multiple versions corresponding to 108 unique packages and extensions, including 19 npm libraries, 10 Composer packages, 61 Go modules, and one Google Chrome extension. Contagious Interview is a North Korea-aligned campaign that weaponizes job recruitment to target software developers and cryptocurrency sector workers, using persuasive job interviews to trick them into executing malicious code since at least 2023.

PolinRider was first flagged by OpenSourceMalware in March 2026, describing threat actors implanting malicious obfuscated JavaScript payloads in hundreds of public GitHub repositories to deliver a new variant of BeaverTail malware. As of April 11, 2026, the activity has compromised 1,951 public GitHub repositories associated with 1,047 unique owners, merging with another cluster called TaskJacker that drops malicious VS Code task files. The VS Code tasks include the ‘runOn: folderOpen’ option to trigger arbitrary code execution when the folder is opened as a workspace.

The attackers take over maintainer accounts, likely through expired domain takeover or account recovery paths. Once executed, the malware searches for specific configuration files and appends malicious JavaScript code. It uses a Windows batch script to stealthily modify the last commit, making changes appear as if made by the original author. The payload functions as a JavaScript malware loader that reaches out to blockchain infrastructure (TRON, Aptos, BNB Smart Chain) to fetch an encrypted second-stage payload that unpacks to DEV#POPPER RAT and OmniStealer.

Users who have installed these packages should treat the environment as compromised, rotate exposed secrets from a clean machine, remove affected versions, and audit developer workstations for hidden execution paths or suspicious commits modifying .vscode/tasks.json, config.js, vite.config.js, and eslint.config.js files.