DPRK PolinRider Campaign Expands to 108 Packages Across npm, Packagist, Go Modules, and Chrome Store; DEV#POPPER and OmniStealer Delivered via Compromised Maintainer Accounts

Socket Threat Research Team linked to North Korea's Contagious Interview / Famous Chollima cluster has compromised 108 legitimate open-source packages and 1,951 public GitHub repositories, planting obfuscated JavaScript loaders that retrieve encrypted second-stage payloads via blockchain RPC infrastructure before dropping DEV#POPPER RAT or OmniStealer. The campaign has expanded beyond npm to Packagist, Go modules, and a Chrome extension, with attackers exploiting expired-domain takeovers to seize legitimate maintainer accounts and push tainted updates through trusted distribution channels. Defenders should audit dependencies against the PolinRider IOC tracker maintained by Socket and treat any tailwindcss-style-animate, tailwind-mainanimation, or sevenspan-namespace Packagist packages as compromised pending investigation.

Defenders should audit dependencies against the PolinRider IOC tracker maintained by Socket and treat any tailwindcss-style-animate, tailwind-mainanimation, or sevenspan-namespace Packagist packages as compromised pending investigation.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the critical severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.