PolinRider Confirmed Footprint Grows 6.5x Since March

PolinRider is a large, active supply-chain campaign attributed to the Lazarus Group that has poisoned developer projects on GitHub by injecting obfuscated JavaScript into build/config files (postcss, tailwind, eslint, etc.) and smuggling code inside a .woff2 font; the July hunt found 2,417 newly-compromised repositories (4,367 cumulative across 2,152 owners), primarily individual developer accounts, and the report provides IOC markers, file targets, detection grep commands, and remediation steps.