North Korean threat actors aligned with the Contagious Interview / Famous Chollima cluster have published 162 malicious release artifacts across 108 packages and browser extensions spanning npm, Packagist, Go modules, and the Chrome Web Store, according to research published by Socket’s Threat Research Team. The campaign, designated PolinRider, has been active since at least March 2026 and remains ongoing as of the reporting date — with researchers confirming new malicious packages continue to appear as attackers cycle through compromised package maintainer accounts.
Campaign Mechanics
PolinRider uses a multi-stage delivery chain designed to evade automated registry scanning. The initial payload is concealed in configuration files or fake .woff2 font files within legitimate-looking packages. On installation, obfuscated JavaScript loaders execute via VS Code auto-run tasks — a technique first merged with the PolinRider operation from the overlapping TaskJacker cluster in April 2026. The loader contacts command-and-control infrastructure hosted on public blockchain RPC nodes, retrieves an encrypted second-stage payload, and decrypts it in memory before execution.
Final-stage malware variants include DEV#POPPER, an information stealer with established attribution to Contagious Interview operations, and OmniStealer, a cross-platform credential harvester targeting browser sessions, cryptocurrency wallets, SSH keys, and cloud service tokens. The blockchain-based C2 model provides resilient infrastructure: takedown of individual servers does not disrupt operations because the RPC endpoint is derived from on-chain state rather than a fixed domain.
The campaign has expanded scope from npm to include Packagist (PHP), Go modules, and Chrome extensions — the last of which is notable because extension installs bypass the developer-focused user population that is the primary target for npm and Go vectors. Chrome extension distribution broadens the reach to any user installing a package that depends on affected code.
Targeting Profile
The PolinRider targeting profile is consistent with Contagious Interview’s documented financial collection mandate. Primary targets are developers with access to cryptocurrency assets, LLM API keys, and cloud credentials. The campaign has demonstrated particular interest in packages used within the AI and Web3 development ecosystems, where individual developers frequently hold high-value credentials tied to significant financial assets.
In at least three confirmed cases, attackers obtained commit access to legitimate packages by submitting genuine-looking pull requests from newly created accounts, building apparent credibility over weeks before inserting malicious code. This account conditioning approach requires more operational investment than simple typosquatting but produces packages that pass initial review — including some automated security checks that do not inspect obfuscated configuration files.
Sectoral Implications
Finance and cryptocurrency: Credential theft from developer workstations has been a consistent revenue source for North Korean operations. OmniStealer targets browser-stored cryptocurrency exchange session tokens and wallet seed phrases. Any organisation with developers working on finance or DeFi applications should treat this campaign as directly relevant.
Communications and enterprise software: The expansion into Go modules and Chrome extensions extends PolinRider’s reach into backend service infrastructure and browser-based enterprise applications. Organisations with internal npm registries or that mirror public registries should verify their mirroring processes validate package content rather than simply replicating downloads.
Critical infrastructure supply chains: Packages affected by PolinRider have been detected in build pipelines for organisations in energy, manufacturing, and government contracting — sectors that were not the primary targeting intent but were reached through transitive dependency exposure.
Recommended Actions
Immediate: Audit currently installed npm, Go, and Packagist dependencies using a software composition analysis tool and compare against the PolinRider indicator lists published by Socket. Specifically check for packages updated between March and July 2026 that include obfuscated JavaScript or .woff2 files in unexpected locations within the package structure.
VS Code task file review: Inspect .vscode/tasks.json files in any repository that has been cloned or merged in the past four months. Malicious tasks inserted by the TaskJacker component execute automatically when a developer opens the repository in VS Code — a user-invisible action that does not require any package installation to trigger.
Chrome extension audit: Review Chrome extensions installed across developer and analyst workstations. Extensions recently published by accounts with no prior extension history, particularly those with permissions for tab access or clipboard read, should be removed pending investigation.
Registry authentication: Enforce two-factor authentication on all npm and Packagist accounts with publish rights. The account-conditioning attack vector depends on the ability to gain publish access to legitimate packages — MFA significantly raises the operational cost.
The Socket advisory includes a complete list of affected package names and hashes. Organisations should configure automated alerts for any dependency pull matching those identifiers.