Executive Summary

Last week’s reporting covered developer ecosystem compromise, digital-asset theft and laundering, and an APT37 RokRAT campaign. PolinRider expanded from npm into Go modules, Packagist packages, and Chrome extensions. The reporting tied that expansion to compromised GitHub accounts and repository release paths, putting source-control identity at the center of package security.

Cross-chain bridges and DeFi infrastructure appeared as both compromise points and laundering routes. A separate APT37 investigation traced spearphishing that impersonated a real academic conference, disguised a loader as a PDF, and used public cloud services for RokRAT command and control.

Key Trends

1. PolinRider crossed package ecosystems

OpenSourceMalware reported almost 200 malicious release artifacts tied to 111 packages and extensions, including more than 80 Go modules and 10 Packagist packages. Because those ecosystems can publish directly from repositories and tags, a stolen GitHub account can become package-registry access. The campaign hid JavaScript in configuration files and fake .woff2 files, used VS Code folder-open tasks, and delivered BeaverTail, InvisibleFerret, OtterCookie, or OmniStealer.¹

CYFIRMA likewise assessed that Famous Chollima was expanding PolinRider beyond npm into Go modules, Packagist, and Chrome extensions. It described compromised repositories and maintainer accounts as paths to developer credentials, browser data, and wallet information, while labeling its associated YARA rule low confidence.²

2. An npm backdoor delayed execution

nodemon-sudo version 3.1.16 copied the legitimate nodemon package but added tslint-conf, a repackaged logger containing a backdoor. The code did not run at installation or import. It waited until the fake logger middleware was called, then spawned a detached Node process, fetched JavaScript through a Pinata IPFS gateway, and executed it with access to require.³

SafeDep linked the package pair to earlier nodemon-node and ts-await activity through reused code and infrastructure. It also noted resemblance to a North Korea-linked npm cluster but said the attribution was based on technique and remained unconfirmed. This distinction matters because delayed execution and IPFS retrieval are useful detection leads, not proof of actor identity.

3. Cross-chain systems joined intrusion and laundering

SlowMist described Lazarus activity as a sequence spanning supply-chain compromise, social engineering, DeFi attacks, cross-chain infrastructure abuse, and laundering. Privacy protocols, bridges, lending platforms, and mixers created layered movement that made tracing harder. Its broader review recorded 182 blockchain incidents and about USD 956 million in first-half losses, with supply-chain attacks causing the largest losses by value.⁴

The Financial Security Institute estimated that Lazarus-linked or suspected activity accounted for about 63 percent of the cross-chain hacking losses it reviewed. Its cases included Ronin Bridge, Harmony Horizon, Orbit Chain, and KelpDAO, with failures involving social engineering, endpoints, validator keys, and RPC infrastructure. Reported laundering methods included decentralized exchanges, Tornado Cash, Railgun, Wasabi CoinJoin, chain hopping, wallet splitting, exchanges, and OTC networks.⁵

4. APT37 delivered RokRAT through a conference lure

Genian’s Korean and English reports assessed that Operation Capsule Vault likely began with a spearphishing email impersonating a real academic conference. An ISO image contained a PIF loader disguised as a PDF. The loader opened a legitimate decoy, decoded shellcode, and injected an x64 RokRAT variant into explorer.exe.⁶⁷

RokRAT collected host and document data, executed commands, and captured screenshots. It used pCloud, Dropbox, and Yandex for command and control. Reused Yandex credentials, infrastructure, implementation details, and code similarity to Operation Artemis supported the APT37 attribution.

What to Watch

Protect GitHub maintainer accounts and release tags with the same care as package-registry credentials. Monitor changes to tasks.json, font files containing script code, unfamiliar transitive dependencies, and Node processes that retrieve code from IPFS or blockchain services.

For document lures, connect ISO mounting, PIF execution, decoy display, process injection, and unusual cloud-service traffic. Cross-chain defenses should separately protect signer endpoints, validator independence, administrative changes, RPC infrastructure, and fund-movement monitoring.

Reports Reviewed