PolinRider supply chain attack: North Korea-aligned threat actors (Contagious Interview / Famous Chollima) published 162 malicious release artifacts across 108 unique packages and extensions spanning npm, Packagist/Composer, Go modules, and a Chrome extension. The actors compromise legitimate maintainer accounts (via expired-domain takeover and account-recovery paths), rewrite Git history with force pushes and anti-dated commits to disguise malicious changes, and publish infected package versions. The payloads deliver a BeaverTail JavaScript malware variant and downstream RATs/stealers (DEV#POPPER, OmniStealer), and abuse VS Code tasks (runOn: folderOpen) to execute arbitrary code when a repository is opened in an IDE. The campaign targets software developers and cryptocurrency-sector personnel. Installing any affected version should be treated as a full environment compromise: rotate exposed secrets from a clean machine, remove affected versions, and rebuild from a known-good lockfile.