North Korean hackers flood open-source repositories with 108 booby-trapped packages
The Contagious Interview crew is back, seeding npm, Packagist, Go and Chrome with malware aimed at developers.
Key points
- Researchers have linked 108 malicious packages and browser extensions to North Korean hackers in a campaign called PolinRider, disclosed this week.
- The packages were published across npm, Packagist, Go and the Google Chrome Web Store.
- The activity is tied to Contagious Interview, a long-running North Korean operation that targets software developers with fake job offers.
- The campaign is still active, with new packages expected as attackers compromise legitimate maintainer accounts.
- Everyday users aren't the direct target: the goal is to reach the companies whose developers install the poisoned code.
North Korean hackers have quietly seeded open-source repositories with 108 malicious packages and browser extensions, part of a campaign researchers are calling PolinRider.
The packages appeared across four places where programmers download building blocks for their apps: npm (used by JavaScript developers), Packagist (used by PHP developers), Go (Google's programming language) and the Chrome Web Store, where browser extensions live.
Think of these repositories as app stores for developers. A programmer building a website grabs ready-made pieces from them to save time. If one of those pieces is booby-trapped, the malware rides along into whatever the developer is building, and often onto their work laptop.
Who are these hackers actually after?
Developers. Specifically, developers at crypto firms and tech companies. The campaign is an offshoot of Contagious Interview, which we first covered on 15 June in "Contagious Interview Pivots to Dev-Review Lures in Two Fresh Campaigns": fake recruiters approach engineers on LinkedIn with a tempting job offer, then ask them to run a "coding test" that quietly installs malware.
PolinRider is the supply-chain version of that idea. Instead of tricking one engineer at a time, the hackers poison the wells that thousands of engineers drink from.
How the packages get onto trusted repositories
Two routes, mostly.
The first is straightforward: attackers create a package with a name close to a popular one, hoping a rushed developer types it by mistake. This is known as typosquatting.
Nastier is the second. Hackers break into accounts of legitimate package maintainers, the real authors other developers already trust, and push a poisoned update from that trusted account. Researchers say this account-takeover pattern is why the campaign keeps producing new packages weeks after it was first spotted.
Once installed, the malicious code typically pulls down a second-stage payload: an information stealer hunting for crypto wallets and browser-saved session cookies. Session cookies let an attacker walk into a logged-in account without needing the password or a multi-factor code, because the cookie represents an already-authenticated session. That's the part that stings on the identity side. MFA wouldn't have stopped it.
What should developers and their employers do?
If you write software, or manage people who do, treat every dependency as untrusted until proven otherwise.
Pin exact versions rather than pulling "latest". Review new maintainers before accepting an update. Run installs inside a sandbox or disposable container, not on the laptop holding your production credentials. Rotate session tokens and API keys on any machine that touched a suspect package, because a stolen cookie is only useful until it's revoked.
For everyone else: you can't directly avoid this one. Many breaches of consumer services start not with the service itself but with a developer's laptop three companies upstream.
Should you worry about more PolinRider packages?
Yes. The campaign's operators have been targeting developers since at least 2023, and our reporting on fake Rollup Helper packages on 3 July showed the same account-compromise playbook already in use before PolinRider was named. The economics keep these crews motivated: a single stolen crypto wallet funds a lot. Expect more packages before the year is out.
