githash
docs
A DPRK campaign (Famous Chollima / Contagious Interview) that plants obfuscated JavaScript in developers' GitHub repositories and published packages. It hides in build config files (postcss, tailwind, eslint, vite, astro) behind whitespace padding, in fake font files such as public/fonts/fa-solid-400.woff2, and in .vscode/tasks.json entries that run on folder open (the TasksJacker vector, now operated by the same actor). The loader resolves its command-and-control through blockchain dead drops, including NullReceiver's empty-Ethereum-transfer technique, then pulls credential and wallet stealers. Infected commits are often force-pushed with their original dates preserved.
- also known as
- TasksJacker, NullReceiver, Contagious Interview
references
- https://github.com/OpenSourceMalware/PolinRider
- https://github.com/OpenSourceMalware/NullReceiver
- https://opensourcemalware.com/blog/tasksjacker-blog-post
- https://socket.dev/blog/polinrider-north-korea-linked-supply-chain-campaign-expands
spread over time
Press play to watch the threat spread, or drag the slider to pick dates.
known-malicious hashes · 10,060
| sha-256 | file names | repos | files | first seen | last seen |
|---|---|---|---|---|---|
| 950f9716fea67fd2… | init |
52 | 73 | ||
| 1b3b4ee36679bf88… | eslint-check.sh |
249 | 250 | ||
| a73c531dc6f5ddda… | eslint-check.cmd |
248 | 249 | ||
| 8c254f8002571f3b… | fa-solid-700.otf |
1 | 1 | ||
| 87d2e94ebb1ab3f2… | fa-solid-300.ttf |
86 | 86 | ||
| ec5da3e32f8ae13a… | init |
83 | 85 | ||
| 6d77cc579824a291… | fa-solid-700.otf |
1 | 1 | ||
| af629a3d8949a684… | fa-solid-700.otf |
2 | 2 | ||
| 7f0192a1b463be6c… | init |
1 | 1 | ||
| 2c3199e20e10edfe… | postcss.config.js |
1 | 1 | ||
| 84d918041e324607… | init |
1 | 1 | ||
| 408b43f05ad04cd1… | fa-solid-700.otf |
1 | 1 | ||
| 4d1b391848cd0f83… | fa-brand-400.woff fa-brands-400.ttf |
154 | 154 | ||
| a55adea8322e8d60… | api.js |
74 | 87 | ||
| fed917df3c4caa69… | tasks.json |
5 | 5 | ||
| 370700d86d67a500… | postcss.config.js |
1 | 1 | ||
| ffe8e08ac0c5dd44… | fa-solid-700.otf |
1 | 1 | ||
| 6a6e8a48f33d2227… | init |
1 | 1 | ||
| b3f608e060161e58… | tasks.json |
406 | 406 | ||
| e97d210dd5f638c4… | fa-solid-900.woff2 |
3 | 3 | ||
| c2bf4f7f74b80ed3… | tasks.json |
18 | 18 | ||
| 15612e9e03731094… | fa-solid-700.otf |
1 | 1 | ||
| 748cd8ad3fbde646… | fa-brand-400.orc |
132 | 133 | ||
| 155f30004d6ce9e9… | init |
76 | 113 | ||
| 3d0f147892489b03… | tasks.json |
9 | 9 |