PolinRider is a North Korean state-sponsored supply chain attack campaign targeting open source developers by compromising maintainer accounts and injecting malicious code into legitimate repositories. The campaign uses obfuscated JavaScript loaders to deliver the DEV#POPPER remote access trojan and OmniStealer information stealer. It spans multiple package ecosystems including NPM, Packagist, Go modules, and Chrome extensions, with at least 162 malicious release artifacts identified across 108 unique packages. Attackers also rewrite Git history to conceal malicious changes. The campaign has been active since December 2025 and is associated with the broader Contagious Interview operation. The compromised packages risk exposing developer environments, package registries, source code, cloud, and CI/CD credentials.

The campaign compromises developer environments by delivering backdoors and information stealers through trusted open source packages. This can lead to unauthorized access to developer machines, theft of sensitive credentials including cloud and CI/CD secrets, and potential further compromise of software supply chains. The integrity of multiple open source ecosystems is undermined, increasing risk for organizations relying on these packages. The attack targets developer trust and supply chain security, potentially enabling widespread downstream impact.

No official patch or fix is applicable since this is a supply chain compromise rather than a software vulnerability. Developers who installed any affected packages or extensions should treat their environments as potentially compromised and perform remediation from a clean machine. Review and audit all installed packages and credentials. Remove and replace any compromised credentials and secrets. Monitor for updates from package maintainers and ecosystem security teams for cleanup and further guidance.