PolinRider DPRK Attack Expands Across GitHub

OpenSourceMalware reports that the DPRK-linked PolinRider supply-chain campaign has markedly expanded (~1,951 compromised GitHub repos across ~1,047 owners) and operationally merged with the TasksJacker cluster; adversaries are abusing malicious npm packages, weaponized take-home templates (ShoeVista, StakingGame), fake .woff/.woff2 font files and .vscode/tasks.json launchers to deliver obfuscated JavaScript loaders which fetch second-stage payloads via blockchain dead-drops and delivery C2s on Vercel, ultimately deploying a cross-platform backdoor/infostealer (InvisibleFerret). The blog provides detailed pivots, newly observed C2 subdomains, IOCs, scanning/remediation commands, and recommends immediate repository and environment auditing, credential rotation, and submission of sightings to OSM.