North Korean Hackers Target Open Source Developers in Supply Chain Attacks
A sophisticated campaign by North Korean hackers has been targeting open source software developers with a backdoor and an information stealer, compromising repositories on GitHub and other package registries to inject malicious code into popular projects. The operation, dubbed “PolinRider,” is part of a broader effort to disrupt the global supply chain and gain access to sensitive data.
The attacks began in December 2025 and have been linked to several previous campaigns, including “Contagious Interview,” which also targeted open source developers with tactics such as compromising maintainer accounts and pushing infected packages. To date, researchers have identified 162 malicious release artifacts across 108 unique packages, with more expected to emerge as the campaign continues.
The compromised repositories contain obfuscated JavaScript loaders that connect to blockchain and public remote procedure call (RPC) infrastructure to retrieve encrypted payloads. The attackers rely on Git history rewriting to make the malicious changes appear older, making it difficult for developers to detect the compromise. In some cases, the hackers have even hidden the malicious loaders in configuration files that were not identified during cleanup operations.
The campaign has expanded to Packagist, where multiple packages under the “sevenspan” namespace were compromised. One notable incident involved the Xpos587 GitHub account, which maintains several repositories that were modified on June 23. The attackers have shown a high level of sophistication and adaptability in their tactics, making it essential for developers and organizations to take immediate action.
The impact of these attacks is significant, as they can compromise package registry credentials, source code, cloud, and CI/CD credentials. As a result, teams that installed affected packages or extensions should treat their installation environment as potentially compromised until reviewed. Remediation should be performed from a clean machine, not the infected host, to prevent further damage.
This campaign highlights the importance of supply chain security in the open source ecosystem. Developers must remain vigilant and take steps to protect themselves and their projects from these types of attacks. By staying informed about emerging threats and best practices for securing open source software, developers can help prevent similar campaigns in the future.
Source: SecurityWeek — 2026-07-06