PolinRider Spreads Through Compromised GitHub Accounts and Packagist
PolinRider campaign exploits compromised GitHub accounts to inject malware into Packagist packages.
The PolinRider campaign has expanded to compromise developer accounts on GitHub, leading to the injection of malicious code into the development branches of the Packagist package visanduma/nova-two-factor. This package has over 700,000 cumulative downloads. The attackers leverage Git-based intrusions, including history rewriting and payload concealment, to spread malware and maintain persistence, often targeting PHP projects. The campaign's primary objective appears to be cryptocurrency theft, with broader information-stealing capabilities also present.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Packagist?
Get an email when a new story names Packagist, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe PolinRider campaign demonstrates a classic software supply chain attack: adversaries compromised developer accounts on GitHub and used that access to inject malicious payloads into a widely-used PHP package (visanduma/nova-two-factor) with over 700,000 cumulative downloads. By rewriting Git history and concealing payloads within development branches, attackers ensured that downstream consumers unknowingly pulled compromised code into their own projects. This matters because developers inherently trust packages from established repositories like Packagist, making supply chain poisoning an extremely high-leverage attack vector. The campaign's goals — cryptocurrency theft and credential harvesting — show that even niche open-source packages can become a gateway to serious financial and data loss across thousands of dependent organizations.
What helps against this
How we list vendors
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- ip — 193.247.144.38
- ip — 166.88.73.46
- ip — 166.88.134.62
- ip — 23.27.13.135
- hash_sha256 — 7d47c430e6e404dc2fa8b4837678d1cbdb4d0aeacec9b405655cab79d54a2ad9
- hash_sha256 — b7ede935d4979146b55f12b9eec7c83b61962b478f5dc9b8db251e539ec2abd3
- hash_sha256 — ccb187dc9de0cc7477c9817ae53365d273e121407c0305f863e2ab67c35d6395
- hash_sha256 — 139ea03dcddf4aa810d55740be3cf6c92ce7a9f3cbcbbb35440e25b769a87683
- hash_sha256 — 515a53291d25d229e1f9fa72e66407e1cfd7e77c91478400b24d5185af68531a