PolinRider Spreads Through Compromised GitHub Accounts and Packagist

The PolinRider campaign continues to spread through compromised GitHub accounts and Packagist, leveraging Git-based infrastructure to inject malicious code into development versions of popular packages. Researchers identified malicious activity in the dev branches of the visanduma/nova-two-factor Packagist package, which has over 700,000 downloads. The attackers use compromised developer accounts to insert obfuscated JavaScript into configuration files and PHP entry points, enabling automatic execution upon repository access or build processes. The campaign employs staged payload delivery via dead-drop resolvers and maintains persistence by rewriting Git history and exploiting IDE integrations such as VS Code tasks.

AI-extracted · verify before operational use