Hundreds of GitHub Repos Compromised By DPRK's PolinRider Campaign

OpenSourceMalware attributes a large supply-chain campaign called PolinRider to DPRK-linked Lazarus actors that has injected heavily obfuscated JavaScript into 675 public GitHub repositories across 352 owners; the initial vector appears to be malicious npm packages or a VS Code extension. The multi-stage payload functions as an infostealer/backdoor that appends to common JS config files, uses blockchain transactions (TRON/Aptos/BSC) as immutable dead-drop C2 with XOR-encrypted payloads executed via eval(), and includes Windows batch tooling that rewrites git commits to hide modifications; the report includes IOCs, affected repository lists, YARA rules, and remediation steps.