Poisoned Pipeline

Poisoned Pipeline / Incidents / AS45

AS45 · 2026-03

PolinRider (DPRK) Git-to-registry jump

Git / GitHubGo modulesPackagist / ComposernpmVS Code / IDE

OpenSourceMalware named PolinRider: unlike Contagious Interview’s fake
interviews, this cluster takes over legitimate GitHub accounts and
injects obfuscated JS into repos the maintainer already owns (config
files, fake .woff2 fonts, .vscode/tasks.json), then uses blockchain
dead-drops for the Lazarus stealer. First report 675 repos; later 1,951
across 1,047 owners, then 4,367. Because Go modules and Packagist
resolve from git tags — no separate publish token — poisoning GitHub
was enough to land artifacts on proxy.golang.org and Packagist. Socket
observed ~200 malicious release artifacts / 111 packages (80+ Go, 10
Packagist, npm, Chrome extensions). AS35 is one Packagist instance.

On 16 October OpenSourceMalware found one repository in a
GhostAction cluster that also carries this loader.
daxitzadafiya/bagisto-dhs has poisoned Tailwind configs, including
tailwind.config.js. A force-push on 25 June 2026 rewrote a commit
whose history date still says 16 April 2025, and added
temp_auto_push.bat. The block reads a pointer from TRON or Aptos
and fetches encrypted code from BNB Smart Chain. Addresses match
indicators already tracked for this campaign. The 15 October
tasks.json and fake font on that same repo report to GhostAction's
server and share no indicator with this loader. That stage is
AS304.

Mapped techniques

supply-chain Maintainer GitHub accounts

T0113 · Initial Access · Compromised user account

Legitimate GitHub maintainer accounts taken over.

T0111 · Resource Development · Malicious code contribution to an open-source repository

Obfuscated loader appended to config / fake fonts / VS Code tasks.

T0154 · Initial Access · Malicious IDE extension

.vscode/tasks.json used as the silent trigger.

T0195 · Defense Evasion · Spoofed commits

Windows script rewrote git history to hide the implant.

post-supply-chain Go / Packagist / npm consumers

T0197 · Initial Access · Use code from untrusted source

go get and Packagist fetched the poisoned git tag with no extra publish step.

T0159 · Execution · Malicious artifact execution

Installing the Go module, Packagist package, or npm library ran the loader.

Sources