North Korea's 108 Malicious Packages Threaten Users

Michael Miller · 2026-07-04

North Korean hackers are at it again. This time, they've published 108 malicious packages and browser extensions across multiple platforms. It's part of a campaign called PolinRider, and it's still active right now. These aren't just random attacks. They're linked to something called the Contagious Interview campaign. The threat actors behind that are now expanding their reach. They're targeting npm, Packagist, Go, and even Google Chrome extensions. ### What's Actually Happening? Here's the deal. These hackers are compromising maintainer accounts. Once they get in, they push out malicious code disguised as legitimate packages. The scary part? New ones keep popping up. The campaign isn't slowing down. - They've published 108 unique packages and extensions so far. - These span npm, Packagist, Go, and Chrome. - The activity is ongoing and likely to continue. - They're using compromised maintainer accounts to spread the malware. Think about that for a second. If you're a developer, you might download one of these thinking it's safe. But it's not. It's a backdoor into your system. ### Why This Matters for You If you work with antidetect browsers or manage multiple accounts, this is a big deal. These packages could be used to steal your data, track your activity, or compromise your accounts. The last thing you want is a North Korean hacker getting access to your setup. I've been in this space for years. I've seen attacks evolve. But this one feels different. It's broad. It's targeting multiple ecosystems. And it's persistent. ### How to Protect Yourself So what can you do? First, be careful what you install. Stick to well-known packages. Check the publisher's history. Look for red flags like recent account activity or weird version numbers. Second, use an antidetect browser that prioritizes security. Not all of them do. Some are built for convenience, not protection. You need one that isolates your sessions and blocks malicious scripts. Third, keep your tools updated. These hackers are constantly finding new ways in. The updates often patch vulnerabilities they might exploit. ### The Bigger Picture This isn't just about 108 packages. It's about how sophisticated these attacks are getting. The hackers aren't just phishing or sending malware links. They're infiltrating the supply chain. They're becoming part of the tools we trust. That's a scary thought. But it's also a reminder. We need to stay vigilant. We need to question everything. Even the stuff that looks safe. The campaign is called PolinRider. And it's not going away anytime soon. The threat actors are committed. They're compromising accounts, pushing updates, and expanding their reach. ### Final Thoughts Look, I know this sounds alarming. But it's better to be aware than to be caught off guard. Take this seriously. Audit your dependencies. Check your extensions. And if something feels off, trust your gut. The internet is a wild place right now. But with the right precautions, you can stay ahead of these threats.