North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign

**PolinRider / Contagious Interview:** A North Korea-linked active campaign has been infecting open-source ecosystems and developer tooling by publishing malicious npm, Composer, Go, and Chrome extension packages and injecting obfuscated JavaScript into public GitHub repositories and VS Code tasks; the loaders fetch encrypted second-stage payloads (DEV#POPPER RAT, OmniStealer) via blockchain infrastructure. The activity leverages maintainer account takeover or compromised packages, Git history rewriting to hide changes, and VS Code auto-run tasks to trigger execution, affecting many repositories and posing supply-chain and credential-exfiltration risks.