North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign

Summary

The North Korean threat actors linked to the Contagious Interview campaign have been observed publishing 108 unique packages and web browser extensions spanning npm, Packagist, Go, and Google Chrome as part of an ongoing activity referred to as PolinRider. "The campaign remains active, and new malicious packages are likely to continue appearing as threat actors compromise maintainer accounts,

SpinGraph analysis pending — check back after processing.

• 19-Year-Old Scattered Spider Suspect Extradited to Face U.S. Hacking Charges
• Unpatched Argo CD Repo-Server Flaw Could Let Attackers Take Over Kubernetes Clusters
• SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation
• New ChocoPoC RAT Targets Vulnerability Researchers via Fake PoC Exploit Repos
• FortiBleed Credential Theft Linked to INC and Lynx Ransomware Operations
• AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack