The Invisible Patch: How PolinRider Rewrites Git History to Hide North Korean Malware

OSM researchers uncovered 'PolinRider', a DPRK-linked campaign that has compromised 1,951 public GitHub repositories (1,047 unique owners) by appending heavily obfuscated JavaScript to project config files and using a Windows batch script (temp_auto_push.bat) to alter system clock and amend commits so the malicious changes appear native; initial vectors include compromised npm packages and malicious VS Code extensions, and the actor leverages weaponized take-home coding templates to lure developers.