Executive Summary
The North Korean threat group Famous Chollima (associated with the Contagious Interview campaign) has significantly expanded the PolinRider supply chain operation. The campaign targets open-source ecosystems including npm, Packagist, Go, and Chrome extensions, with over 160 malicious artifacts identified. The threat actor typically compromises maintainer accounts to insert obfuscated JavaScript loaders into legitimate repositories, often using Git history rewriting to mask their presence.
Technically, the actor employs advanced hiding techniques such as whitespace padding in configuration files and concealing loaders within fake '.woff2' font files. These payloads are triggered via developer tools like VS Code task files. Once active, the loaders communicate with blockchain RPC infrastructure (TRON, Aptos, BNB) to retrieve encrypted second-stage malware such as DEV#POPPER and OmniStealer.
This campaign poses a critical risk to software developers and organizations, as it results in the theft of credentials (npm, GitHub, cloud services), browser data, and cryptocurrency wallets. Impacted organizations must assume full environment compromise and perform remediation from uninfected hosts, prioritizing secret rotation and the auditing of developer workstation configuration files.