PolinRider: 108 packages from North Korea + $1M ransom

The Contagious Interview-linked group has uploaded 108 malicious npm, Composer, Go modules and a Chrome extension, compromising nearly 2,000 GitHub repos. By hijacking maintainer accounts they inject obfuscated JavaScript that alters build configs and launches arbitrary code, keeping the PolinRider supply‑chain attack active.

A U.S. government agency paid Kairos about $1 million to stop the leak of over 2 TB of stolen files, after negotiations saw the demand drop from $3 million. The case study shows the extortion group’s rapid fund‑splitting across crypto exchanges, highlighting the rising threat of data‑only ransom attacks on high‑profile targets.