North Korean PolinRider campaign floods open-source registries with 108 malicious packages
The Contagious Interview-linked group has uploaded 108 malicious npm, Composer, Go modules and a Chrome extension, compromising nearly 2,000 GitHub repos. By hijacking maintainer accounts they inject obfuscated JavaScript that alters build configs and launches arbitrary code, keeping the PolinRider supply‑chain attack active.