364/69 Monday, July 6, 2026
Security researchers have identified activity by a state-sponsored threat group under a campaign named PolinRider, which is linked to the Contagious Interview operation. The group has been distributing 108 malicious packages and web browser extensions through software development platforms such as npm, Packagist, Go, and Google Chrome. The campaign has targeted software developers and personnel in the cryptocurrency industry since 2023 by using fake companies, fraudulent job offers, and fake job interviews to trick victims into running malicious code.
Initial analysis found that the threat actors did not use stolen GitHub account passwords. Instead, they took over administrator accounts through other methods, such as hijacking expired domains. They then embedded malicious code in more than 1,951 public source code repositories. The attackers used obfuscation techniques and combined them with TaskJacker methods to create VS Code task files that execute immediately when developers open the project folder. In addition, the malware can modify system configuration files and alter Git history to remove traces, making the changes appear as if they were made by the legitimate developer. The malware then connects to blockchain networks to download remote access tools and information-stealing malware for installation in the next stage.
For prevention and risk mitigation, users or administrators who find that affected packages have been installed should assume that the environment may have been compromised. They should immediately rotate passwords and all business secrets from a trusted and secure computer. In addition, they should remove the affected package versions and rebuild systems from configuration files that have been verified as safe. They should also thoroughly review code history and file behavior, especially .vscode/tasks.json settings and other configuration files, to identify and block any hidden malicious activity. These measures can help prevent potential damage to the organization in a timely manner.