North Korean PolinRider Campaign Floods 108 Packages Across npm, Go, Packagist, and Chrome
North Korean actors have broadened the PolinRider supply‑chain campaign to npm, Packagist, Go modules and a Chrome extension, injecting 162 malicious releases across 108 packages. The attackers hide obfuscated JavaScript loaders in legitimate repositories, stealing developer credentials and pushing blockchain‑based payloads. Teams must treat affected environments as compromised, rotate secrets, and audit repo histories.