The North Korean threat actors behind the Contagious Interview campaign have released 108 malicious software packages and browser extensions across the npm, Packagist, Go module registry, and Google Chrome Web Store as part of an ongoing supply chain operation designated PolinRider. The campaign remains active, with additional malicious packages expected as attackers continue compromising maintainer accounts and injecting infected code into legitimate repositories.
Scope of the PolinRider Supply Chain Attack
Security researchers have identified 162 malicious release artifacts spanning multiple versions across 108 unique packages. The breakdown includes 19 npm libraries, 10 Composer packages for PHP, 61 Go modules, and one Google Chrome browser extension. The operation targets software developers and cryptocurrency sector professionals through fake job interviews and coding assessments that trick victims into executing malicious code.
Contagious Interview activity has been documented since at least 2023. Attackers pose as recruiters or collaborators on platforms such as LinkedIn, GitHub, and freelance job sites, often establishing elaborate front companies with AI-generated employee profiles to build credibility and deliver malware.
How PolinRider Compromises Developer Workflows
As of April 2026, the PolinRider campaign had compromised 1,951 public GitHub repositories belonging to 1,047 unique owners. The operation has merged with a related cluster called TaskJacker, which inserts malicious Visual Studio Code task files into existing GitHub repositories. These task files use the runOn: 'folderOpen'codecodecodecode trigger to execute arbitrary code the moment a developer opens the folder as a workspace in VS Code or Cursor.
Rather than using stolen GitHub credentials, the attackers compromise victims through malicious VS Code extensions or npm packages. Once a developer is infected, the malware searches for specific configuration files including postcss.config.mjscodecodecodecode, tailwind.config.jscodecodecodecode, eslint.config.mjscodecodecodecode, next.config.mjscodecodecodecode, babel.config.jscodecodecodecode, and app.jscodecodecodecode, appending obfuscated JavaScript code to each file it finds.
The attackers employ a Windows batch script to stealthily modify the most recent commit while preserving the original author attribution. Similar tools are believed to be used for rewriting Git history on Linux and macOS systems, making malicious changes appear older and less suspicious.
Second-Stage Payload Delivery via Blockchain
The JavaScript malware loader deployed in the latest wave reaches out to blockchain infrastructure services on TRON, Aptos, and BNB Smart Chain to fetch an encrypted second-stage payload. This decrypts to deliver DEV#POPPER RAT, a remote access trojan, and OmniStealer, a credential and data theft tool. The technique leverages blockchain transactions as a resilient command-and-control channel that is difficult to takedown.
Git History Manipulation and Detection Challenges
A core tradecraft element throughout the PolinRider campaign involves rewriting Git history through force pushes and anti-dated commits. This makes the GitHub landing page and visible commit history unreliable for detection. Security analysts recommend reviewing repository activity logs, package release metadata, VS Code task configuration files, and suspicious modifications to configuration files rather than relying on commit timestamps.
What Affected Users Should Do Now
Anyone who has installed packages associated with the PolinRider campaign should treat their development environment as compromised. Immediate steps include rotating all exposed secrets, API keys, and credentials from a clean machine, removing affected package versions, and rebuilding dependencies from a known good lockfile. Developers should audit their workstations and repositories for hidden execution paths, particularly examining .vscode/tasks.jsoncodecodecodecode, config.jscodecodecodecode, vite.config.jscodecodecodecode, and eslint.config.jscodecodecodecode for suspicious modifications. Organizations should implement a multi-layer endpoint protection solution with behavioral analysis capable of detecting anomalous JavaScript execution and supply chain tampering. Enabling two-factor authentication on all package registry accounts and monitoring account activity for unauthorized maintainer changes are essential preventive measures.
