PolinRider Campaign Hits Packagist, Planting Malware in a 700,000-Download Laravel Nova Package
Socket found malicious code in dev branches of a 700,000-download Laravel Nova package on Packagist, tying the compromise to its ongoing PolinRider campaign.
Overview
Socket researchers said they identified malicious code in the dev-main version of visanduma/nova-two-factor, a Packagist package with more than 700,000 cumulative downloads, as what the firm calls the PolinRider campaign continues to spread through compromised developer accounts and Git repositories, according to Socket. The malicious code is present only in unstable dev-* versions of the Laravel Nova two-factor authentication package, and Socket says no stable malicious release has been identified at the time of its report.
What We Know
Socket first published technical details of the PolinRider campaign in July 2026, describing it as a persistent operation that distributes malware across npm, PyPI, Go modules, Packagist, and Chrome extensions, according to Socket. PolinRider “has spent at least five months getting into thousands of developer machines any way it can: fake interviews, poisoned forks, malicious VS Code tasks, typosquatted packages,” according to The Hacker News. The Machine Herald previously reported on six npm packages tied to the same PolinRider campaign that decoded command-and-control addresses from Ethereum transactions, as previously reported. In the latest finding, Socket says its analysis of the Visanduma GitHub organization indicates its repositories have been compromised since mid-June 2026, with the malicious changes introduced through the LaHiRu developer account. Public contribution activity shows hundreds of contributions to private repositories after the account was compromised, which Socket says prevents researchers from determining the campaign’s full repository-level reach.
Four malicious dev-* package versions have been identified: dev-nova4support, dev-main, dev-using-inertia, and dev-nova5, according to Socket.
Socket describes the campaign’s model as “package-registry compromise is often a consequence of a broader Git-based intrusion rather than the campaign’s primary objective.” The operators compromise developer accounts and insert malicious content into source repositories, then rely on ordinary developer actions — cloning a repository, opening it in an IDE, or running a normal build or test — to begin the infection chain, Socket says.
According to Socket, the campaign repeatedly uses four techniques: force-pushing rewritten Git history to introduce or replace malicious code and complicate review; concealing malicious JavaScript in configuration files or in files presented as .woff2 fonts; triggering automatic execution through patched build configuration or a "runOn": "folderOpen" entry in .vscode/tasks.json that fires when a developer opens the repository in a VS Code–compatible IDE; and resolving command-and-control infrastructure through a dead-drop mechanism — using techniques Socket names as EtherHiding and, more recently, NullReceiver — before downloading later-stage infostealer payloads.
Socket also reported a new PHP-specific technique: heavily obfuscated JavaScript inserted directly into index.php and executed through PHP’s shell_exec function, allowing a PHP entry point to launch the JavaScript infection chain directly. Socket says the appearance of this variant suggests the operators adapt execution methods to the opportunities available in each compromised project rather than relying on one fixed delivery path.
Socket’s published indicators of compromise include a dead-drop resolver Ethereum address (0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a), four resolved command-and-control IP addresses, and five SHA256 hashes for malicious tailwind.config.js files used to conceal payloads.
Socket says package registries function as a secondary spread channel for the campaign rather than its main distribution method: because Go modules and Packagist can resolve code directly from Git repositories, malicious source code already planted in a repository can become available through a registry without the operators needing to steal publishing credentials or tokens. Socket attributes the campaign’s apparent primary objective to cryptocurrency theft, while noting that the broader information-stealing capabilities of the delivered malware may also expose credentials and source code. Socket also describes the operators as “North Korea-linked” and says a major disruption of the group appears unlikely in the near term.
What We Don’t Know
Socket says GitHub code search reflects only the current public state of repositories, and therefore misses private repositories touched by compromised accounts, repositories that were infected and later cleaned, and developer systems where malicious code executed before a repository was cleaned up. The full scope of accounts and projects affected by the LaHiRu compromise, and whether any stable (non-dev-*) release of visanduma/nova-two-factor has since been affected, remained undetermined as of Socket’s report.
Guidance From Socket
Socket’s recommendations for affected or potentially affected developers include avoiding the dev-main branch of visanduma/nova-two-factor until the repository is confirmed clean, auditing repository history for force-pushes and unfamiliar commits rather than only the current tree, inspecting .vscode/tasks.json entries and .woff2 files for hidden execution paths, treating any confirmed execution as a full host compromise requiring reimaging, and rotating GitHub tokens, package-registry credentials, cloud keys, and other accessible secrets, according to Socket.