PolinRider

PolinRider is the cluster where nobody is tricked. A legitimate repository has malicious code written into configuration files developers rarely read, such as postcss.config.mjs, tailwind.config.js, eslint.config.mjs and .vscode/tasks.json, and the project builds and runs as before.

OpenSourceMalware reports more than 2,400 affected repositories across over a thousand owners, almost all of them victims of a compromised account, a merged malicious pull request or a tampered dependency. The list is published as a hunting aid and carries that warning on every page.

Named individuals

None profiled on this site yet

Fabricated personas

None reconstructed under this tag

Indicators

151 in the searchable index

Hunts

1 in the hunt library

How it differs from the other clusters here

The payload is the one Contagious Interview delivers, reported by OpenSourceMalware as operationally merged; the difference is delivery.

Removing the lure removes every social signal: no recruiter to check, no interview, no application to correlate.

A developer pulling a tampered dependency is compromised without being contacted.

Command and control is reported to read encrypted instructions from TRON and Aptos wallet addresses, which cannot be seized or sinkholed.

This resembles the EtherHiding tracker and OtterCookie's reported smart-contract reads, but the three are related in approach, not confirmed as one technique.

Compare Lazarus GroupAPT38KimsukyRGB (Reconnaissance General Bureau)Remote Worker Fraud / Contagious InterviewAndarielAPT37KonniMoonstone Sleet

What a defender would see

The observable is a configuration file changing when nothing about the project's configuration did, such as postcss.config.mjs or tailwind.config.js in an unrelated pull request.

.vscode/tasks.json executes on folder open, so it belongs in review scope.

On the dependency side, lockfile discipline and review of transitive updates do more than any endpoint control.

The DPRK Repo Scanner offers a remote GitHub search and a local signature scan of a checkout; treat results as leads.

An affected repository is far more likely a victim than a participant, and nothing on that page accuses its owner.

• TTP Hunt medium PolinRider: Config-File Injection and Git History Rewrite A build-tool config file such as postcss.config.mjs growing an obfuscated tail, a .vscode/tasks.json that runs on folder open, and scripts that amend and force-push the last commit under its original timestamp: the PolinRider campaign. WindowsmacOSLinux Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · YARA · osquery

Indicators

The 151 indicators the index holds under this cluster. The complete index is on Remote Workers.

Show more results

Where the evidence comes from

Show 50 more

Further reading

Published research on this cluster. None of it is this site’s work.

• PolinRider OpenSourceMalware · 2026-07-10

  The primary source for the campaign and the origin of the compromised-repository list this site republishes. Read it first: it carries the injection signatures, the config files targeted, and the per-snapshot repository counts.

• North Korea's Contagious Interview Campaign Escalates: 338 Malicious npm Packages, 50,000 Downloads Socket.dev · 2025-10-10

  The registry side of the same problem. Useful here because the npm packages in this site's ruleset for this campaign impersonate Tailwind and PostCSS utilities, which is what makes a tampered config file look unremarkable.

• Lazarus-Linked npm Malware Masquerades as Rollup Polyfills JFrog Security Research · 2026-06-30

  A worked example of build tooling used as the hiding place rather than the target. Read it for what a malicious package pretending to be part of the toolchain actually looks like in a project tree.