North Korean Hackers Unleash 108 Malicious Packages in PolinRider Campaign

Robert Moore · 2026-07-04

The North Korean threat actors behind the Contagious Interview campaign have stepped up their game. They have published 108 unique packages and web browser extensions across npm, Packagist, Go, and Google Chrome. This ongoing activity is called PolinRider, and it shows no signs of slowing down. "The campaign remains active, and new malicious packages are likely to continue appearing as threat actors compromise maintainer accounts," researchers warn. This is a serious wake-up call for developers and cybersecurity teams alike. ### What Is PolinRider? PolinRider is a coordinated attack targeting open-source ecosystems. The hackers compromise legitimate developer accounts and inject malicious code into seemingly harmless packages. Once installed, these packages can steal credentials, exfiltrate sensitive data, or create backdoors into your systems. The attackers are spreading their net wide, hitting multiple platforms at once. This makes detection harder because the malicious code can blend in with legitimate updates. ### How Does It Affect You? If you or your team use open-source libraries, you are at risk. The infected packages can enter your codebase through automated updates or direct installations. Once inside, they can compromise your entire infrastructure. - **Data theft**: Login credentials, API keys, and personal information can be stolen. - **Backdoor access**: Hackers can gain remote control over your systems. - **Supply chain attacks**: Your software can become a vector to infect your clients. ### Why This Matters for Antidetect Browser Users As an antidetect browser specialist, I see a direct link here. Many of you rely on browser extensions for privacy and security. But if a malicious extension sneaks into the Chrome Web Store, it can bypass your defenses. The PolinRider campaign specifically targets browser extensions, which means your digital fingerprinting tools could be compromised. ### What You Can Do Right Now Here are practical steps to protect yourself: - **Audit your dependencies**: Review all packages and extensions you use. Check for recent updates from unfamiliar maintainers. - **Use package lock files**: Lock your dependencies to specific versions to prevent automatic updates from pulling in malicious code. - **Enable two-factor authentication**: Protect your package manager accounts from being hijacked. - **Monitor for suspicious activity**: Set up alerts for unusual network traffic or changes in your extensions' behavior. The PolinRider campaign is a reminder that open-source security is a shared responsibility. Stay vigilant and regularly update your security practices. ### Final Thoughts This attack is not just a headline. It is an active threat that is evolving every day. By understanding the tactics and taking proactive measures, you can reduce your risk. Remember, your digital privacy is only as strong as the tools you trust.