`https://github.com/user`

https://github.com/user is a GitHub account that 2 published sources report in connection with PolinRider and Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from OpenSourceMalware and Socket. The earliest of those reports is dated 2026-02-27 and the most recent 2026-07-08.

github profile PolinRider Contagious Interview MATCHED IN SOURCE live checked 2026-09-18

Listed as user

First seen 2026-02-27 · last seen 2026-07-08

live checked 2026-09-18

The image is the avatar this account displays, not evidence of who operates it.

Sources

…go get github.com/user/thing@v1.4.0 asks the module proxy ( proxy.golang.org ) for that tag, and the proxy fetches whatever is in that git commit.…
PolinRider Jumps the Fence to Go, Packagist, npm, PyPI | OpenSourceMalware — OpenSourceMalware · under “Model B — the registry resolves from the Git repo” · published 2026-07-08 · pulled 2026-09-11
Nearby text:

…); } // Reads each file, extracts credential lines } function extractCredentialsFromUrl ( url ) { // Parses: https://username:token@github.com/user/repo.git // Parses: https://token@gitlab.com/user/repo.git // Extracts and stores auth tokens } Repository Scanning # Scans all drives up…
StegaBin: 26 Malicious npm Packages Use Pastebin Steganography to Deploy Multi-Stage Credential Stealer | Socket — Socket · under “Git Credential Extraction #” · published 2026-02-27 · pulled 2026-09-12

Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.

Related indicators

Cited by the same report: StegaBin: 26 Malicious npm Packages Use Pastebin Steganography to Deploy Multi-Stage Credential Stealer | Socket

Socket lists 12 other indicators in this source.