Hackers Compromise GitHub Maintainer Accounts to Publish PolinRider

A widescale escalation in the PolinRider supply‑chain campaign: threat actors have compromised GitHub maintainer accounts to publish infected package versions across multiple ecosystems.

The investigation identified 162 malicious release artifacts across 108 unique packages and extensions in npm, Packagist, Go modules, and a Chrome extension, linking this activity to the broader North Korean Contagious Interview / Famous Chollima developer‑targeting cluster.

PolinRider’s tradecraft remains methodical and developer‑focused. Operators gain maintainer access often by compromising GitHub accounts or abusing account recovery and expired domain vectors then alter legitimate repositories to introduce obfuscated JavaScript loaders.

These loaders are hidden using two primary techniques: embedding one‑line payloads padded with whitespace so the executable code is pushed beyond default viewport width, or concealing payloads as fake .woff2 font files.

Execution is often triggered via developer tooling, notably VS Code task configurations with “runOn”: “folderOpen”, which causes the hidden payload to run when a developer opens the project.

A representative case involves the Xpos587 GitHub account, where multiple unrelated repositories were modified in a tight time window on June 23, 2026 behavior consistent with account takeover.

According to Socket , telemetry shows the campaign has moved beyond npm into additional ecosystems: 80 compromised Go modules, 10 Packagist packages, and one Chrome extension were observed in addition to npm artifacts.

In that case, malicious Go module releases were published after repository modifications, demonstrating how repository compromise can propagate into registry artifacts when attackers obtain publishing credentials.

A critical evasive technique used by PolinRider is Git history rewriting. Operators perform force pushes and anti‑date commits to make malicious changes appear older and benign.

That practice undermines reliance on the GitHub file view and visible commit timestamps as indicators of compromise; defenders must inspect repository Activity logs and force‑push events, not just the apparent commit history.

Socket’s analysis of repositories such as markfetch and other Xpos587 projects shows exactly this pattern: repository pages that look unchanged, while the Activity tab reveals recent history rewrites.

In the Xpos587 case, malicious versions of affected Go modules were published after repositories under the account were modified.

Once deobfuscated, the JavaScript loaders blockchain and public RPC services (TRON, Aptos, BNB Smart Chain) to retrieve encrypted second‑stage payloads.

These are decrypted using embedded XOR keys and executed via eval(). Known follow‑on payloads observed include DEV#POPPER and OmniStealer, delivering remote‑access capabilities, credential and wallet theft, and C2 functionality via socket.io.

The loader architecture, however, means the campaign is modular and capable of delivering additional malware families as operators adapt.

Defenders should assume compromise for any environment that installed affected versions. Immediate actions include preserving forensic artifacts, identifying all developer machines that pulled the malicious artifacts, removing affected versions, and rebuilding from known‑good lockfiles.

Additional hunting should target VS Code tasks configured to run on folder open and commands that execute atypical file types (for example, node executing .woff2 files).

Rotation of exposed secrets npm, GitHub, PyPI, RubyGems, cloud, CI/CD, SSH, and application keys must be performed from a clean machine.

Repositories should be audited for suspicious edits to .vscode/tasks.json, config.js, vite.config.js, eslint.config.js, and font/static asset directories, and registry publication histories should be compared against repository activity for unexpected releases.

Note: IP addresses and domains are intentionally defanged (e.g., [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Mayura Kathir is a cybersecurity reporter at GBHackers News, covering daily incidents including data breaches, malware attacks, cybercrime, vulnerabilities, zero-day exploits, and more.

A Mac-targeting ClickFix campaign amplified through a verified X ad, and a novel browser-based…

A newly disclosed forensic investigation has revealed that Pegasus spyware was used to hack a…

Scammers are exploiting consumers’ trust in household and financial brands by deploying polished fake Google…

Alibaba is reportedly preparing to ban the use of Anthropic’s Claude Code across its internal…

Threat actors are currently exploiting sophisticated ClickFix social engineering campaigns that mimic Google and Cloudflare…

A newly disclosed vulnerability in Microsoft Exchange, identified as CVE-2026-45504 (CVSS score: 8.8), exposes a…