6th July – Threat Intelligence Report · 2026-07-06
Researchers elaborated on a North Korea-aligned supply-chain campaign dubbed PolinRider, which published 108 malicious packages and a Chrome extension across open-source registries. The attackers abused VS Code auto-run tasks and hidden JavaScript loaders to fetch second-stage malware and deploy DEV#POPPER and OmniStealer.
Software developers via npm, Packagist, Go, and Chrome Web Store · 2026-07-04
Researchers at Socket report North Korean threat actors linked to Contagious Interview published 108 malicious packages and browser extensions across npm, Packagist, Go, and Chrome in the ongoing PolinRider campaign. [Date Occurred: Since at least 07/12/2025; Date Discovered: 07/12/2025]
PolinRider: North Korea-Linked Supply Chain Campaign Expands Across Open Source Ecosystems · 2026-07-01T17:53:56.469Z
PolinRider expands across npm, Packagist, Go modules, and Chrome extensions, using hidden loaders to target developer environments.
PolinRider and related North Korean-linked supply chain activity (in CISO Executive Briefing July 2026) · 2026-07-29T14:21:23+00:00
Supply-chain velocity and sophistication – North Korean-linked actors (PolinRider and related) published >100 malicious packages and extensions across npm, Packagist, Go, and Chrome ecosystems.