PolinRider Compromises 108 Packages via Maintainer Takeovers and Git History Rewrites Since December 2025
PolinRider reveals a deliberate North Korean strategy of compromising open-source maintainer accounts to embed persistent backdoors across software supply chains. The campaign's use of Git rewriting and blockchain C2 extends beyond typical phishing, indicating operational maturation. Continued monitoring of registry telemetry is essential to disrupt the pattern before it reaches critical infrastructure components.
Registry operators and maintainers should expect continued expansion into additional language ecosystems. Independent monitoring of commit velocity and account access logs will be required to detect the next wave before widespread distribution occurs.
Socket Security: At least 75 new malicious packages will appear in Go modules and Chrome Web Store within 120 days.
Sources (3)
- [1]Primary Source(https://www.securityweek.com/north-korean-hackers-target-open-source-developers-in-supply-chain-attacks/)
- [2]Supporting Source(https://socket.dev/blog/polinrider-campaign-analysis)
- [3]Supporting Source(https://www.mandiant.com/resources/blog/contagious-interview-north-korea)