DPRK PolinRider Campaign Expands to 108 Malicious Packages Across npm, Packagist, Go, and Chrome Store; DEV#POPPER and OmniStealer Deployed

North Korean threat actors linked to the Contagious Interview / Famous Chollima cluster have expanded their PolinRider supply chain campaign to 162 malicious release artifacts across 108 unique packages in npm, Packagist, Go modules, and a Chrome extension, with the campaign active since December 2025. The JavaScript loaders fetch encrypted second-stage payloads via public blockchain infrastructure (TRON, Aptos, BNB Smart Chain) that unpack to the DEV#POPPER RAT and OmniStealer credential harvester. Attackers use force-pushed Git commits with anti-dated timestamps to make malicious changes appear historical, significantly complicating forensic triage.

The JavaScript loaders fetch encrypted second-stage payloads via public blockchain infrastructure (TRON, Aptos, BNB Smart Chain) that unpack to the DEV#POPPER RAT and OmniStealer credential harvester.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.