Build1 publisher2 min readPublished
Socket finds PolinRider in four dev-* versions of a 700,000-download Packagist package
Socket reports no malicious stable release. The exposure sits with teams that resolve dev-* constraints directly, and with anyone who clones the repository and opens it in a VS Code-compatible IDE.
The Engineer · Build desk
What happened
- Socket's threat research team found malicious code in the dev-main version of visanduma/nova-two-factor, a Packagist package with more than 700,000 cumulative downloads.
- The PolinRider operators planted the malware in four development versions of the package using a compromised GitHub account.
- The malicious code sits only in the unstable dev-* versions; Socket had not identified it in any stable release at the time of writing.
- Socket's analysis indicates the Visanduma GitHub organization's repositories have been compromised since mid-June 2026, with the changes introduced through the LaHiRu developer account.
- After the takeover, that account's public activity shows hundreds of contributions to private repositories. Socket says that leaves it unable to determine the campaign's full repository-level reach.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- cost Each consuming team has to scope its own exposure, because the public download total does not separate stable installs from dev-branch resolutions.
- exposure A CI job that clones this repository and runs a build or test is one of the triggering actions, even if the package was never installed from Packagist.
- capability Git-resolving ecosystems let the operators reach Packagist consumers straight from the repository, so token rotation and publish-side 2FA leave the path open.
- precedent If registry compromise trails a Git intrusion in this campaign, response work starts with repository and account audit logs before package versions.
Packagist and Go modules can both resolve code directly from a Git repository, and Socket gives that as the reason the operators can skip registry credentials entirely [11]. Malicious source already committed to a branch becomes installable through a second ecosystem while the publishing token and the release process stay untouched [11]. A dev-* constraint resolves against the repository itself, so what arrives is whatever the branch holds when the resolver runs.
The download figure is cumulative over every version the package has published, and Socket did not break the total down by version [1]. The researchers wrote that the distinction "limits conclusions about exposure through normal stable package installation, but users consuming the development branches directly may be affected" [12].
The registry is the second path here. Socket's post lists cloning a repository, opening it in an IDE, and running a normal build or test as the actions that start the infection chain [8]. One technique the team has seen repeatedly is `"runOn": "folderOpen"` in `.vscode/tasks.json`, which fires when a developer opens the repository in a VS Code-compatible IDE [9]. Viewing the repository on the web does not fire the folderOpen task. Malicious content has also turned up inside `.woff2` font files, which Socket describes as places developers are less likely to inspect during code review [10].
For the folderOpen trigger to reach you, someone has to open the checkout in a VS Code-compatible IDE [9]. A build agent that clones and runs a test suite never opens a folder in an editor; it falls under the other actions on Socket's list [8].
PHP projects keep recurring in this campaign, and earlier infections crossed ecosystems by planting JavaScript in project configuration files [13]. The newer variation puts heavily obfuscated JavaScript straight into `index.php` and executes it through PHP's `shell_exec` [14]. Socket takes the change as the operators fitting the execution method to whatever a given compromised project offers [15].
Public data leaves the affected set open past this one package [2]. For a consuming team the check is narrow: whether any constraint in the tree resolves a dev-* version, and whether anyone has cloned the repository onto a workstation. Socket contrasts PolinRider with campaigns that publish a malicious version and race defenders, describing a slower model that runs on developer collaboration in Git-based services [16].
What to watch
- Whether a stable release of visanduma/nova-two-factor is ever cut from the compromised branches. Socket has yet to identify one.
- Any disclosure of which private repositories the LaHiRu account touched after the takeover. That would be the first public bound on reach.
- More PHP projects carrying obfuscated JavaScript in index.php. Another sighting would mark the shell_exec route as a technique the operators reuse.