108 Malicious Packages by North Korean Hackers in PolinRider

Emily Davis · 2026-07-04

You might think you're safe just because you stick to trusted repositories like npm or the Chrome Web Store. But here's the thing: even those platforms aren't immune to bad actors. Just recently, North Korean hackers linked to the Contagious Interview campaign published 108 unique malicious packages and browser extensions. They spread across npm, Packagist, Go, and Google Chrome, all as part of a sneaky operation called PolinRider. This isn't some one-off event. The campaign is still active, and experts warn that new malicious packages will keep popping up. The threat actors are getting better at compromising maintainer accounts, which means they can inject malware into code that looks legit. For developers and IT pros in the US, this is a wake-up call. ### How the Attack Works The attackers don't just dump malware and hope for the best. They use a technique called "supply chain poisoning." First, they take over a legitimate maintainer's account, often through phishing or credential theft. Then, they push updates that include malicious code. Since the account is trusted, the packages get downloaded by unsuspecting users. Think of it like this: if a trusted friend hands you a cup of coffee, you don't test it for poison. The same goes for packages from reputable accounts. The PolinRider campaign exploits that trust, and it's working. - **108 packages** total across four platforms - Targets include npm (JavaScript), Packagist (PHP), Go (Go modules), and Chrome extensions - Malware can steal credentials, install backdoors, or exfiltrate data ### Why This Matters for US Professionals If you're a developer, system admin, or IT manager in the United States, this campaign directly affects your security posture. Many US companies rely on open-source packages for everything from internal tools to customer-facing apps. A single compromised package can open the door to a full-scale breach. And it's not just about code. The Chrome extensions are especially dangerous because they run in the browser. That means they can capture keystrokes, read cookies, and even take screenshots of your activity. For anyone handling sensitive data, that's a nightmare scenario. ### What You Can Do to Protect Yourself Don't panic, but do take action. Here are some practical steps to reduce your risk: > "The best defense is a good offense. Audit your dependencies regularly and never assume a package is safe just because it's popular." 1. **Audit your dependencies**: Use tools like npm audit or Snyk to scan for known vulnerabilities. 2. **Enable two-factor authentication**: Protect your own accounts to avoid becoming a compromised maintainer. 3. **Monitor for suspicious updates**: If a package you use suddenly changes behavior, investigate before updating. 4. **Limit permissions**: For browser extensions, only install what you need and review permissions carefully. 5. **Stay informed**: Follow security news from trusted sources to catch alerts about new campaigns. ### The Bigger Picture PolinRider is just one example of a growing trend. State-sponsored groups are increasingly targeting software supply chains because it gives them a high return on investment. One malicious package can infect thousands of systems, all without the attacker needing to break into each one individually. For US businesses, this means security can't be an afterthought. It needs to be baked into every stage of development. That includes vetting third-party code, training employees on phishing risks, and having a response plan ready. The hackers aren't slowing down, and neither should you. By staying vigilant and adopting these best practices, you can minimize the chance that your systems get caught in the next wave of attacks. Stay safe out there.