PolinRider Caused Dozens of npm and Go Compromises

OpenSourceMalware attributes a set of compromises across npm and Go to DPRK’s PolinRider campaign: attackers used VS Code autorun tasks and a disguised JavaScript loader (fa-solid-400.woff2) that resolves XOR-encrypted payloads from blockchain RPCs (TRON, Aptos, BSC) to deliver RATs and infostealers; propagation occurs via a local propagation script (temp_auto_push.bat) that amends commits and forges commit timestamps, and npm publishes via harvested ~/.npmrc tokens — the report includes IOCs (XOR keys, TRON/Aptos wallets, C2 IPs and paths) and remediation guidance for maintainers.