PolinRider Campaign (Contagious Interview - North Korean Supply Chain Attack)

Technical Analysis

The PolinRider campaign extends the established Contagious Interview tactic set, in which North Korean actors compromise or impersonate legitimate package maintainer accounts to publish trojanized packages across multiple ecosystems (npm, Packagist/PHP, Go modules, and Chrome extensions). This multi-registry, multi-language approach increases the attack surface and complicates detection, as defenders must monitor disparate package indices and extension stores simultaneously. The campaign is described as active and ongoing, with new malicious packages likely to appear as additional maintainer credentials are compromised, suggesting continued credential-harvesting or account-takeover techniques as a core enabler. Given that npm and Go packages are commonly pulled into developer tooling, CI/CD pipelines, and backend services, AI agent frameworks and RAG pipelines that programmatically install dependencies (including autonomous coding/DevOps agents) are at direct risk of ingesting these compromised packages, potentially leading to credential theft, backdoor deployment, or exfiltration of API keys used by agent systems.

Affected Systems

Development environments and CI/CD pipelines using npm and Packagist package managers, Go module consumers, Google Chrome browser extension users, and any automated or agentic systems that programmatically fetch dependencies from these registries

Indicators of Compromise

• 108 malicious packages across npm, Packagist, Go, and Chrome Web Store (specific package names/hashes not disclosed in source reporting)
• Compromised maintainer accounts on npm and Packagist
• Malicious Chrome extensions distributed via Chrome Web Store

Remediation Steps

1. 1

   Audit dependency manifests

   Review package.json, composer.json, go.mod, and browser extension inventories for recently added or unfamiliar dependencies, especially those installed near the campaign's active window.

2. 2

   Enable package integrity verification

   Use lockfiles, checksum verification, and provenance/attestation features (e.g., npm provenance, Sigstore) to detect tampered packages before installation.

3. 3

   Restrict automated dependency installation

   For AI agents and CI/CD systems that auto-install packages, enforce allow-lists, pinned versions, and human review gates before pulling new or updated dependencies.

4. 4

   Rotate exposed credentials

   Rotate API keys, tokens, and secrets potentially exposed to compromised packages or extensions, particularly those used by agent tooling and automation pipelines.

5. 5

   Monitor maintainer account security

   Enforce MFA and monitor for anomalous publishing activity on organizational npm, Packagist, and Go module accounts to prevent account takeover contributing to further distribution.

6. 6

   Remove suspicious browser extensions

   Audit installed Chrome extensions across the organization and remove any unverified or recently published extensions matching known campaign indicators.