North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign

The North Korean threat actors linked to the Contagious Interview campaign have been observed publishing 108 unique packages and web browser extensions spanning npm, Packagist, Go, and Google Chrome as part of an ongoing activity referred to as PolinRider. "The campaign remains active, and new malicious packages are likely to continue appearing as threat actors compromise maintainer accounts,

According to Socket and The Hacker News, North Korea-linked actors in the PolinRider campaign have published 162 malicious release artifacts across 108 packages and browser extensions in npm, Packagist, Go modules, and Chrome, using compromised maintainer accounts and obfuscated loaders hidden in config files and fake font assets.[1][2][3] These packages target developer environments, enabling credential theft, browser data theft, command execution, and wallet exfiltration via payloads such as DEV#POPPER and OmniStealer.[1][2] From a CyberSE.AI perspective, similar techniques can be used to target AI development and deployment pipelines, poisoning dependencies in model training environments, CI/CD for AI services, or agent runtime toolchains. Organizations should implement SBOM-based dependency monitoring and hardened developer workflows for AI systems, treat any environment that consumed affected packages as potentially compromised, and conduct readiness assessments focused on securing AI build and deployment supply chains.