108 Malicious Packages Found in PolinRider Campaign

Robert Moore · 2026-07-04

North Korean hackers are at it again. This time, they've published 108 malicious packages and browser extensions across multiple platforms including npm, Packagist, Go, and Google Chrome. The campaign, known as PolinRider, is an extension of the earlier Contagious Interview activity. These threat actors aren't slowing down. They're actively compromising maintainer accounts to push dangerous code into the open-source ecosystem. If you're a developer or a security professional, this is a wake-up call. ### What Is PolinRider? PolinRider is the name researchers have given to this ongoing operation. It's linked to the same North Korean group behind the Contagious Interview campaign. The goal? Sneak malware into legitimate-looking packages that developers might download without a second thought. The packages span several ecosystems: - npm (JavaScript) - Packagist (PHP) - Go modules - Google Chrome extensions That's a wide net. And it means anyone working with these tools could be at risk. ### Why This Matters for Your Security If you're using antidetect browsers to manage multiple identities or protect your privacy, you need to pay attention. Malicious browser extensions can steal cookies, session data, and even bypass two-factor authentication. Once installed, they can track your every move online. Antidetect browsers are designed to give you control over your digital fingerprint. But if you install a compromised extension, you're handing that control back to hackers. ### How to Protect Yourself Here's what you can do right now to stay safe: - Only install browser extensions from trusted sources. Check reviews and download counts. - Regularly audit your installed packages and extensions. Remove anything you don't recognize. - Use a dedicated antidetect browser that isolates your sessions. This limits the damage if something goes wrong. - Keep your software updated. Patches often fix vulnerabilities that hackers exploit. - Be skeptical of packages with few downloads or recent uploads. They could be part of a campaign like PolinRider. ### The Bigger Picture This campaign isn't going away anytime soon. The threat actors are persistent. They're targeting maintainer accounts because those have built-in trust. Once they're in, they can publish updates that look legitimate but contain hidden code. For professionals using antidetect browsers, this means staying vigilant. Your browser is your gateway to the web. If it's compromised, everything else is at risk. ### A Quote to Keep in Mind "The campaign remains active, and new malicious packages are likely to continue appearing as threat actors compromise maintainer accounts." This isn't just a warning. It's a reality we all have to navigate. ### Final Thoughts Staying safe online requires constant attention. The tools you use, like antidetect browsers, are powerful. But they're only as secure as the extensions and packages you add to them. Think twice before installing anything new. Verify before you trust. Your digital identity is worth protecting. Don't let a malicious package undo all your hard work.