Open the folder, run the malware. North Korea hides it in a font file, and keeps renaming the font.

01 How the fake font runs

PolinRider’s version of that file has three parts [ OSM Sep 2026 ] :

• A harmless name. The task is labelled eslint-check. It looks like a code-quality step.
• No trace on screen. It is set to "reveal": "never" and "hide": true, so no terminal opens.
• A font that is code. The command runs node against a file in a fonts folder. The "font" is obfuscated JavaScript, often pushed far to the right behind hundreds of tabs so it looks empty in an editor.

The copy we read on GitHub on 6 November went further. It chains the command three ways, so it runs on macOS, Linux and Windows, and fails silently where Node is missing.

Once running, the script looks up its next stage in public blockchain transactions. Addresses on TRON, Aptos and Ethereum hold the server details, so there is no fixed domain to block [ OSM Mar 2026 ] . The stealer then takes saved logins and cookies from Chrome, Edge, Brave and Firefox and targets about 150 browser extensions for password managers and crypto wallets [ GitGuardian 2026 ] . Other samples take SSH keys, environment variables and GitHub tokens.

02 The renaming game

For most of 2026 one GitHub search found thousands of infections: the font name plus tasks.json. Defenders shared it widely. The attackers noticed.

Sources: OpenSourceMalware, January and September 2026 [ OSM Jan 2026 ] [ OSM Sep 2026 ] . Our GitHub code search on 6 November counted 2,470 task files pointing at fa-brand-400.orc, 888 at fa-solid-900.woff2 and 462 at fa-solid-400.woff2. Search counts move daily and include repositories that were already cleaned.

The researchers call it A/B testing. Each new name runs alongside the old one until defenders catch up. The payload also moved out of the top-level public/fonts folder into deeply nested project paths. A rule that matches a file name or a path is out of date within weeks.

The font is not even the main route any more. In July, about 94% of infected repositories carried the code inside build configs such as postcss.config.mjs, tailwind.config.js and eslint.config.mjs, after the export, where it runs during an ordinary build. The fake font accounted for about 6% [ OSM Jul 2026 ] . And not every fake font is PolinRider. A copycat called GhostAction reuses the same task and font trick to steal cloud, npm, PyPI and SSH credentials, plus Claude and Gemini config files [ OSM Oct 2026 ] .

03 How it reaches your team

Three routes, all through normal developer work.

• A job interview. The fake-font trick first appeared in North Korea’s Contagious Interview operation. A recruiter on LinkedIn sends a "coding assessment" on GitHub. The candidate opens it. In January the full infection took under 40 seconds [ OSM Jan 2026 ] .
• A repository you trust. Because PolinRider pushes with real developers’ credentials, the infected repository can be a client project, a contractor’s template or an open-source tool your team already uses.
• A package. Malicious packages linked to the campaign have appeared on npm, Packagist and Go, and in a Chrome extension. The earliest PolinRider npm versions date from May 2025 [ OSM Oct 2026 ] .

VS Code closed the easiest door in February. Since version 1.109 the task.allowAutomaticTasks setting defaults to off [ VS Code 1.109 ] . VS Code then asks once per workspace, and automatic tasks "never run in an untrusted workspace" [ VS Code docs ] . That helps only if the developer says no. A candidate under time pressure on an assessment clicks Trust and Allow. So does someone opening what looks like a colleague’s repository. Machines where the setting was switched on earlier, and older or forked editors, have no prompt at all.

04 What to check today

A team lead can run the first four checks this afternoon. Detect on what the code does, never on a file name.

OpenSourceMalware publishes a free scanner script for the known markers [ PolinRider scanner ] . Use it, and expect the next rename to miss it. What decides the damage is what one developer laptop can reach once it is infected. In a 14-day penetration test we show you exactly that: the repositories, pipelines and cloud keys, ranked, with the change that cuts each path. Start with your Threat Map. Enterprise-grade. Not enterprise-priced.