North Korean Hackers Launch Widespread Supply Chain Attacks on Open Source Developers
A sophisticated campaign by North Korean hackers has been targeting open source software developers across various platforms, compromising their repositories and injecting malicious code into legitimate packages. The operation, referred to as PolinRider, is part of a broader supply chain attack that has been ongoing since December 2025.
The attackers have been using compromised GitHub repositories injected with JavaScript loaders leading to the DEV#POPPER remote access trojan (RAT) and the OmniStealer information stealer. These malicious packages have been distributed through popular package managers such as NPM, Packagist, Go modules, and Chrome extensions. To date, researchers have identified 162 malicious release artifacts across 108 unique packages, with more expected to emerge as the campaign continues.
One of the ways the hackers are compromising repositories is by tampering with maintainer accounts, allowing them to push infected packages that appear to be legitimate. They also rely on Git history rewriting to make the malicious changes appear older, making it harder for developers to detect and remove the backdoors. The compromised repositories contain obfuscated JavaScript loaders that connect to the blockchain and public remote procedure call (RPC) infrastructure to retrieve encrypted payloads.
The campaign has expanded beyond GitHub, with multiple packages under the sevenspan namespace on Packagist being compromised. The attackers hid the malicious loaders in configuration files that were not identified during the cleanup operation. This highlights the importance of having robust security measures in place when working with open source software, as well as regular monitoring and review of dependencies.
The PolinRider campaign is associated with a broader operation called Contagious Interview, which includes tactics seen in previous campaigns such as DeceptiveDevelopment, Operation Dream Job, and ClickFake Interview. The scope of the attack suggests that North Korean hackers are actively targeting developer environments, potentially exposing package registry, source code, cloud, and CI/CD credentials.
As a result, teams that have installed affected packages or extensions should treat their installation environment as potentially compromised until reviewed. Remediation should be performed from a clean machine, not from the potentially infected host, to prevent further compromise. This is a stark reminder of the importance of supply chain security and the need for developers and organizations to prioritize robust security measures when working with open source software.
In light of this campaign, it’s essential for developers to regularly review their dependencies, monitor their repositories, and implement robust security measures to prevent similar attacks in the future. By doing so, we can reduce the risk of supply chain attacks and ensure the integrity of our digital infrastructure.
Source: SecurityWeek — 2026-07-06