← threat actors
threat actor · not yet in the cluster map
polinrider
5 stories · 5 in the wild · June 17, 2026 – August 2, 2026
evidence: 5 observed
how they got in
- package registry 4 · Aug 2
- supply chain 1 · Jul 3
sectors
- developers 5 · Aug 2
- technology 1 · Jul 8
geography
- north korea 3 · Jul 8
- dprk 1 · Aug 2
malware and tools
- beavertail 2 · Jun 18
- invisibleferret 2 · Jun 18
- jsonkeeper 1 · Jul 8
techniques
- supply chain 5 · Aug 2
- obfuscation 1 · Jun 18
- typosquatting 1 · Jun 17
attack phases seen
- Initial access 5 · Aug 2
- Execution 3 · Jul 8
- Resource development 1 · Jul 3
what we reported, newest first, grouped by story
August 2, 2026
- DPRK actor "PolinRider" behind dozens of npm, Go, and PHP compromises. New analysis extends the North Korean campaign already linked to the axios/debug/chalk incidents (earlier coverage), detailing how developer machines are hijacked via social engineering to silently push malicious releases; recommended mitigations include token rotation, dependency scanning, and access hardening (opensourcemalware.com).
· Aug 2 · observed · via package registry · Supply Chain
July 8, 2026
- North Korea's PolinRider supply-chain campaign continues to expand, with new malicious Go modules and fresh JSONKeeper-based C2 URLs dropping and executing loaders via Node, per Nextron and Socket tracking. Nextron
· Jul 8 · observed · via package registry · Threat Activity
July 3, 2026
- Socket detailed PolinRider, a North Korea-linked supply-chain campaign compromising legitimate GitHub repos with malicious commits — often a one-line obfuscated JavaScript loader padded with whitespace to push it off-screen. Socket, blackorbird.
· Jul 3 · observed · via supply chain · Threat Activity
Jun 17 – June 18, 2026 · 2 reports
- DPRK-linked PolinRider continues evolving —
tailwind-color-shades typosquat uses a blockchain dead-drop loader chain (TRON→Aptos→BSC→XOR→eval) to deliver Beavertail → InvisibleFerret, with a new XOR key and obfuscator build (Nextron).
· Jun 18 · observed · via package registry · Supply Chain - PolinRider/DPRK npm typosquats (
tailwind-color-shades, twcompose-utils, classbreeze-utils) ship real plugins plus obfuscated droppers fetching OS-specific second stages (Beavertail → InvisibleFerret) from blockchain dead-drops and IP 194.11.226.41. Nextron Research.
· Jun 17 · observed · via package registry · Supply Chain