North Korean Hackers Conceal JavaScript Loaders in Open Source Repos
Key Takeaways North Korean threat actors are deploying malicious JavaScript loaders in a widespread supply chain attack dubbed “PolinRider.” The campaign has infected 162 release...
Key Takeaways
- North Korean threat actors are deploying malicious JavaScript loaders in a widespread supply chain attack dubbed “PolinRider.”
- The campaign has infected 162 release artifacts across 108 unique packages and extensions, including Go modules, Packagist packages, and a Chrome extension.
- Attackers use sophisticated methods to conceal payloads, including hiding obfuscated JavaScript in configuration files and disguising it as legitimate font files.
- Compromised GitHub accounts are being used to inject malicious code and manipulate repository histories to evade detection.
- The malware payloads, DEV#POPPER and OmniStealer, are capable of remote command execution and exfiltrating sensitive data like credentials, browser information, and cryptocurrency wallet details.
North Korea-Linked Hackers Conceal JavaScript Loaders in Open Source Repositories
A sophisticated new supply chain attack, identified as “PolinRider,” is actively targeting developers by embedding malicious JavaScript loaders within trusted open-source code repositories. This campaign, attributed to North Korean threat actors, represents a significant expansion of their tactics, moving beyond traditional phishing to directly compromise the software supply chain.
Table Of Content
Security researchers have linked PolinRider to North Korean groups known as Contagious Interview and Famous Chollima. These entities have a history of targeting software engineers with deceptive job offers and compromised coding challenges. PolinRider appears to be an evolution of this strategy, now leveraging seemingly legitimate packages to deliver its malicious payloads.
The scope of PolinRider is particularly alarming due to its multi-ecosystem reach. Initially observed on npm, the campaign has since infiltrated Packagist, Go modules, and even a Chrome extension, indicating a broad and adaptable attack strategy. This versatility allows the attackers to exploit a wider array of development environments.
Socket.dev said in a report that their analysis uncovered 162 malicious release artifacts distributed across 108 unique packages and extensions. This includes 80 compromised Go modules, 10 Packagist packages, and one Chrome extension. The sheer volume and diversity of compromised assets highlight the significant threat this campaign poses to the open-source community.
The insidious nature of PolinRider lies in its ability to blend malicious code seamlessly into legitimate files, making detection difficult for developers. Many may have inadvertently installed or executed compromised packages without any indication of a security breach.
Evasive Tactics and Payload Delivery
The attackers behind PolinRider employ a combination of established and novel techniques to maintain stealth. Early iterations of the campaign involved burying obfuscated JavaScript within common configuration files, such as those ending in config.js. This method relies on developers typically not scrutinizing every line of configuration code.
More recently, the threat actors have advanced their obfuscation by disguising malicious scripts as fake .woff2 font files. This file format is highly unlikely to be inspected by developers, providing an effective cover for the hidden payload. The execution of these scripts is triggered through Visual Studio Code task files, which can be configured to run automatically when a project folder is opened, ensuring silent activation.
Once activated, the loader establishes connections to various blockchain and public RPC services, including TRON, Aptos, and BNB Smart Chain networks. These connections are leveraged to retrieve an encrypted second-stage payload. The payload is then decrypted using an embedded XOR key and executed via the eval function, a common technique for dynamic code execution.
Analysis of the retrieved payloads reveals the deployment of malware such as DEV#POPPER and OmniStealer. Both are potent information stealers and remote access tools. They communicate with attacker-controlled servers using socket.io-client and are designed to exfiltrate sensitive data, including user credentials, browser data, and cryptocurrency wallet information.
Account Compromise and Repository Manipulation
A critical component of the PolinRider campaign involves the compromise of developer accounts and subsequent manipulation of repositories. For instance, a GitHub account named Xpos587 showed suspicious activity on June 23 at 10:00 UTC, where multiple repositories linked to it were modified within a short timeframe. This synchronized activity strongly suggests an account takeover rather than routine maintenance.
Specific repositories associated with the Xpos587 account, including Xpos587/git2md and Xpos587/markfetch, were found to contain the hidden JavaScript loader. Another independent project, Artiffusion-Inc/mirofish, was also compromised. While markfetch utilized the fake font file trick, mirofish concealed its payload within a vite.config.js file.
On Packagist, the campaign expanded under the sevenspan namespace, associated with the 7span organization. The 7span/react-list package was identified among those affected. Although maintainers removed the fake font files upon discovery, obfuscated code embedded in configuration files often remained, underscoring that partial remediation is insufficient.
The attackers further sophisticated their evasion tactics by manipulating Git history, employing force pushes and backdated commits to make tampered code appear older and more legitimate than it truly is. This technique means that relying solely on visible commit history on platforms like GitHub is unreliable. Defenders must review direct activity logs for a complete and accurate picture of repository changes.
What You Should Do
- Assume compromise: Any environment that has run an affected package should be treated as compromised until a thorough investigation proves otherwise.
- Preserve forensic evidence: Before remediation, ensure all relevant logs and system states are captured for forensic analysis.
- Rebuild from trusted sources: Rebuild development environments and applications from known good lockfiles or clean backups.
- Rotate secrets: Immediately rotate all exposed credentials, API keys, and other secrets from a clean, uninfected machine.
- Audit VS Code tasks: Review all Visual Studio Code task files (e.g.,
.vscode/tasks.json) for any tasks configured with"runOn": "folderOpen"that could trigger malicious scripts. - Inspect repository changes: Scrutinize repository activity logs for suspicious modifications to critical files like
tasks.json,config.js, andvite.config.js, paying close attention to force pushes or backdated commits. - Implement supply chain security tools: Utilize tools that scan for malicious packages and detect anomalies in dependencies.
- Educate developers: Reinforce best practices for validating the authenticity and integrity of open-source packages before integration.
Indicators of Compromise (IoCs):-
No Comment! Be the first one.