Executive Summary

Last week’s reporting returned to two recurring routes into trusted environments: compromised developer accounts and fraudulent remote employment. PolinRider operators retained control of a legitimate developer’s GitHub identity, infected all seven of his active repositories, and published new malicious versions after an earlier npm takedown. Huntress, meanwhile, documented suspected DPRK workers using altered identity records, location-masking services, and hardware that provided remote control and redirected audio or video.

AhnLab’s July survey of attacks against South Korean targets found LNK files were the most common delivery format in the activity it observed. The documented chains used PowerShell, scheduled tasks, cloud services, DLL side-loading, and several backdoors.

Key Trends

1. PolinRider survived a version-specific npm takedown

OpenSourceMalware traced repeated malicious changes to the GitHub account of developer Diogo Angelim. Coordinated force-pushes changed all seven of his active repositories within seconds on July 31 and again on August 23. The pushes came through the legitimate developer identity, which indicated control of usable credentials, a trusted development environment, or both.¹

The first malicious fetch-page-assets release hid the NullReceiver loader in a file presented as a font and used .vscode/tasks.json to run it when a project opened in VS Code. npm removed version 1.2.9 after a GitHub advisory, but the launcher remained in later releases. Subsequent versions placed another obfuscated loader in babel.config.cjs, where Babel or Jest could execute it during builds and tests, including on CI systems.¹

By the time of publication, versions 1.2.9 through 1.2.14 were affected in different ways. The case demonstrates why removing one tarball is not enough when an attacker still controls the maintainer account or development environment. OpenSourceMalware reported a broader confirmed PolinRider footprint of 4,367 repositories across 2,152 owners.¹

2. Remote-worker investigations combined identity and endpoint evidence

Huntress investigated five people across healthcare, financial services, IT, sales and marketing, and medicine who were assessed as likely DPRK remote workers. Three accounts at an Australian organization repeatedly used Astrill VPN nodes and other proxy infrastructure. Their activity times aligned more closely with North Korean working hours than the employees’ claimed locations, while files in their OneDrive accounts contained passports, identity cards, and utility bills with matching templates, metadata, errors, and production patterns.²

A separate investigation found a PiKVM V4 Mini attached soon after a company computer reached a residential address. The device permits browser-based hardware control even before the operating system boots. Huntress also found a Guermok USB capture card registered as a webcam and an altered profile image copied from a legitimate GitHub account. A later threat hunt for the same PiKVM and Guermok combination identified another recently hired employee using suspect identity records, audiovisual redirection services, recording tools, and publicly exposed meeting invitations.²

Huntress based its assessments on the combined pattern of endpoint events, authentication records, browser and cloud activity, infrastructure, working hours, device evidence, and defects in identity documents. That method is better suited to workers who enter through normal onboarding and receive valid accounts than controls designed only to catch account takeover.²

3. LNK files led South Korean spearphishing activity

AhnLab’s Korean and English reports on July APT activity said LNK shortcuts accounted for the largest share of attacks observed against South Korean targets. The reports described several chains rather than one campaign. Common steps included extracting decoy documents and scripts, running PowerShell or AutoIt, and creating scheduled tasks disguised as software updates.³⁴

Follow-on activity used GitHub, Google Drive, Dropbox, and PubNub for payload delivery or command traffic. The chains deployed information stealers, keyloggers, Python backdoors, XenoRAT-type malware, and DLLs loaded through side-loading or regsvr32.exe. Collected data included system details, running processes, key-file lists, and information related to virtual assets.³⁴

Together, the reports document delivery and persistence patterns active against South Korean organizations during the month.³⁴

What to Watch

Users of fetch-page-assets should remove the dependency or pin it to version 1.2.8 or earlier, then inspect repositories and developer hosts for unfamiliar .vscode/tasks.json, disguised JavaScript in non-code files, and payloads appended to configuration files. Review CI logs for unexpected Node.js execution and outbound access during builds or tests. A maintainer compromise requires account, repository, token, and build-environment cleanup, not only removal of a known package version.

Hiring and security teams should correlate identity checks with endpoint and authentication evidence after onboarding. Investigate unexplained PiKVM or Guermok devices, persistent remote-control hardware, geography that conflicts with working hours, altered profile images, and identity documents that share templates or metadata. For South Korean targets, review LNK execution followed by PowerShell, AutoIt, HTA files, scheduled tasks, cloud-hosted payloads, or unusual regsvr32.exe activity.

Reports Reviewed