PolinRider Spreads Through Compromised GitHub Accounts and Packagist

The PolinRider campaign compromises developer GitHub accounts to inject malicious code into development versions of popular packages, including visanduma/nova-two-factor on Packagist. It targets multiple ecosystems such as npm, PyPI, Go modules, Packagist, and Chrome extensions by abusing Git-based collaboration workflows rather than directly compromising package registries. The attackers use advanced techniques like rewriting Git history, hiding payloads in configuration and font files, and triggering execution via IDE tasks. PHP projects are specifically targeted with obfuscated JavaScript executed through shell_exec calls. The campaign is attributed to North Korean actors focusing on cryptocurrency theft.

• Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens StumblesMalware2026-10-26
• Shutting the Door on the XCPE BotnetMalware2026-11-02
• Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealerMalware2026-10-31
• Black October for AI Developer PlatformsCampaign2026-10-31
• September 2026 Threat Trend Report on APT Attacks (South Korea)Malware2026-10-30