Poisoned Pipeline / Incidents / AS82
Neutralinojs org force-push (DPRK / PolinRider)
On 2 March 2026 at 04:38–04:40 UTC compromised contributor alphagamer7
force-pushed four Neutralinojs repos (neutralinojs, neutralino.js,
neutralinojs-cli, github.io) in 132 seconds. Commits were backdated
5–35 days and attributed to maintainer shalithasuranga or
github-actions[bot]; GitHub triggering_actor showed the real pusher.
Payloads hid after hundreds of spaces in JS configs, used BeaverTail,
and pointed at Vercel C2. OSM tied it to PolinRider and the same
obfuscation family in 106+ other repos. OSM opened a cleanup PR;
Vercel took down the C2.
Mapped techniques
- T0113 Compromised user account
- T0195 Spoofed Commits
- T0111 Malicious code contribution to an open-source repository
- T0169 Push implants across repositories
- T0172 Runtime backdoor
supply-chain stolen contributor force-push
Long-time contributor alphagamer7 used to force-push.
Backdated timestamps; author spoofed as maintainer or github-actions[bot].
Whitespace-hidden JS loaders in four org repos.
Four repos plus extra branches in 132 seconds.
BeaverTail / blockchain C2 family also seen in Joyfill (AS66).