PolinRider Spreads Through Compromised GitHub Accounts and Packagist

As cited

Copy frozen at 2026-09-17 23:03 UTC (site build).

threat intel

PolinRider Spreads Through Compromised GitHub Accounts and Packagist

Socket researchers identified malicious code in development versions of visanduma/nova-two-factor, a Packagist package with over 700,000 cumulative downloads, as part of the ongoing PolinRider campaign. PolinRider primarily spreads through compromised developer accounts and Git repositories rather than direct package-registry attacks, using techniques including Git history rewriting, payload concealment in configuration files and font files, and automatic execution through build systems and IDE triggers. The campaign targets multiple ecosystems including npm, PyPI, Go modules, Packagist, and Chrome extensions, with a primary objective of cryptocurrency theft and secondary theft of credentials and source code.

Why it matters: Developers using visanduma/nova-two-factor dev-main branches face malware infection through IDE or build execution; developers across affected projects must audit repository history for force-pushes and compromised accounts, isolate and reimage workstations that cloned or built affected repositories, and rotate all accessible credentials including GitHub tokens, registry credentials, and cloud keys.

Source published

2026-09-17 15:33 UTC

First seen by Cybersecurity Tracker

2026-09-17 18:21 UTC