Executive Summary

Organizations are currently being targeted by a highly coordinated, North Korean state-sponsored malware campaign known as PolinRider (also associated with the Contagious Interview or Fake Font campaigns). This campaign weaponizes developer trust and open-source ecosystems by infecting shared repositories.
The malware exploits Visual Studio Code (VS Code) workspace files to execute obfuscated JavaScript disguised as font files. Once triggered, it deploys multi-stage remote access trojans (RATs) and infostealers—such as InvisibleFerret, DEV#POPPER, and BeaverTail—to steal environment variables, browser cookies, SSH keys, and GitHub OAuth tokens. The stolen credentials are then used to force-push malicious code to other repositories the victim has access to, silently propagating the infection.

Technical Details

The attack typically begins when a developer is socially engineered (often by fake recruiters on LinkedIn offering "take-home coding assessments") or tricked into cloning a malicious fork or installing a compromised npm package.
Once the infected repository is opened in VS Code, the attack unfolds automatically:

1. Auto-Execution: A malicious .vscode/tasks.json file is configured with the "runOn": "folderOpen" setting, which triggers automatically when the workspace is opened.
2. Fake Font Payload: The task executes obfuscated JavaScript hidden inside a fake web font file, typically named public/fonts/fa-solid-400.woff2.
3. Loader & Payload Delivery: The Node.js execution reaches out to attacker-controlled infrastructure (sometimes using blockchain networks for resilience) to fetch secondary payloads.
4. Credential Theft & Propagation: The final payload steals the developer's identity (such as GitHub tokens) and utilizes batch scripts like temp_auto_push.bat to rewrite Git history and push the malware to other repositories, masking the unauthorized commits as legitimate actions.

Indicators of Compromise (IoCs)

Malicious Files & Paths

• .vscode/tasks.json (specifically containing "runOn": "folderOpen")
• .vscode/settings.json
• public/fonts/fa-solid-400.woff2
• temp_auto_push.bat
• temp_interactive_push.bat
• branch_structure.json
• vscode-bootstrap.cmd
• env-setup.npl

Code Markers / Obfuscation Strings

If the following strings are found within configuration files or PR diffs, the repository may be compromised:

• rmcej%otb%
• _$_1e42
• global['!']
• Cot%3t=shtP
• function MDy(f)
• global['_V']

Network Domains & IPs

• api-web3-auth[.]vercel[.]app
• oracle-v1-beta[.]vercel[.]app
• price-oracle-v2[.]vercel[.]app
• vscode-load[.]onrender[.]com
• ip-api-check-gold[.]vercel[.]app
• 144[.]172[.]116[.]80

Mitigation and Recommendations

1. Disable VS Code Auto-Run Tasks: Ensure developers are utilizing VS Code version 1.109 or higher, which introduces the task.allowAutomaticTasks setting. This should be set to "off" to prevent unintended execution of .vscode/tasks.json files.
2. Audit Workspaces and Repositories: Security teams should review configuration files (like tasks.json, tailwind.config.js, etc.) and block .woff2 files from being executed via Node.js.
3. Rotate Credentials: If a machine is suspected of being compromised, immediately revoke all GitHub OAuth applications, Personal Access Tokens (PATs), SSH keys, cloud API tokens, and local development secrets.
4. Implement Workspace Trust: Educate developers to heavily scrutinize untrusted repositories and utilize VS Code's "Workspace Trust" feature to limit code execution in unknown folders.
5. Beware of Social Engineering: Conduct developer awareness training specifically addressing "Fake Recruiter" coding assessments and the dangers of cloning unverified repositories from external sources.

References

• Developer-targeting campaign using malicious Next.js repositories | Microsoft Security Blog
• North Korea is turning open-source projects into malware traps - Cybernews
• North Korean Hackers Abuse VS Code Auto-Run Tasks to Deploy StoatWaffle Malware - The Hacker News
• North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign - The Hacker News
• PolinRider Malware Disclosure · sam1am anyapk · Discussion #64 - GitHub
• Security: Your project is being targeted by the PolinRider supply-chain campaign (malicious forks identified) · Issue #39299 · apache/superset - GitHub
• VS Code tasks.json abuse enables multi-stage infostealer deployment - ThreatLocker