North Korea just made its malware payload host itself on the blockchain- 252
July 5, 2026
North Korean threat actors behind the long-running Contagious Interview campaign have distributed more than 100 malicious packages and browser extensions across four separate software ecosystems — npm, Go, Packagist, and the Chrome extension store — compromising roughly 2,000 GitHub repositories and more than 1,000 unique developer accounts in the process. The campaign, dubbed PolinRider by the researchers who documented it, represents both a scale increase and a technical evolution in North Korea's software supply-chain playbook: the latest version of its BeaverTail malware now fetches its second-stage payload directly from public blockchain networks, making the infrastructure behind the attack effectively impossible to take down through conventional means.
Socket's researchers catalogued the campaign's footprint precisely: 108 unique malicious packages and extensions across 162 release artifacts, broken down into 19 npm packages, 10 Packagist libraries, 61 Go modules, and a single Google Chrome extension. The distribution mechanism traces back to Contagious Interview's signature social-engineering approach, active since at least 2023: North Korean operators impersonate recruiters or business partners across social media and code-hosting platforms, luring developers into installing malicious software during what appears to be a legitimate technical interview or collaboration process. Crucially, researchers found no evidence of direct GitHub infrastructure compromise — instead, attackers hijack individual developer accounts through domain takeover or account-recovery abuse, then use that access to install a malicious Visual Studio Code extension or npm package under the victim's own credentials, letting each compromise organically propagate further through the developer's own trusted publishing history.
Once installed, BeaverTail behaves like a patient infiltrator rather than a smash-and-grab tool. It searches the compromised project's directory specifically for common JavaScript configuration files — Tailwind CSS, Next.js, Babel, and ESLint configs among them — and stealthily inserts malicious code directly into those files, a targeting choice that maximizes the odds the tampered configuration silently propagates into every build that depends on it. The malware then tampers with the project's own Git commit history, rewriting commit messages and timestamps to erase the forensic trail a defender would otherwise use to identify exactly when and how the compromise occurred. The most notable evolution in this campaign is what happens next: rather than reaching out to a conventional command-and-control server that defenders could identify and block, the latest BeaverTail variant retrieves its encrypted second-stage payload directly from the TRON, Aptos, and BNB Smart Chain blockchain networks — using public, decentralized, effectively unseizable infrastructure as a dead-drop for malware delivery. The decrypted payload then deploys DEV#POPPER, a remote access trojan, alongside OmniStealer, a credential and data exfiltration tool, completing the compromise.
The remediation guidance researchers are giving developers reflects how thoroughly this style of compromise can embed itself: anyone who installed an affected package should treat their entire development environment as compromised rather than simply removing the offending package, rotate SSH keys and access tokens from a separate, uncompromised machine, reinstall all project dependencies strictly from a trusted lockfile rather than trusting cached or already-resolved packages, and manually review commit history and project files for tampering that automated tooling may not flag, given BeaverTail's demonstrated ability to rewrite that very history to cover its tracks.
