PolinRider Campaign: Defending Against North Korean Supply Chain Attacks in npm, Go, and Chrome

---
title: PolinRider - Suspicious Shell Spawn by Package Managers
id: 8a4b2c10-9e6d-4f5a-8b1c-2d3e4f5a6b7c
status: experimental
description: Detects npm, composer, or go processes spawning cmd, powershell, or bash, a common TTP in malicious package execution.
references:
  - https://thehackernews.com/2026/07/north-korean-hackers-publish-108.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.execution
  - attack.t1059.001
  - attack.initial_access
  - attack.t1195.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\npm.cmd'
      - '\npm.exe'
      - '\composer.phar'
      - '\go.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wsl.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate build scripts that require shell access
level: high
---
title: PolinRider - Chrome Extension Loading from Dev Paths
id: 1d2e3f4a-5b6c-7d8e-9f0a-1b2c3d4e5f6a
status: experimental
description: Detects Google Chrome loading extensions from unusual paths or temp directories, indicative of malicious sideloading or unpacked extensions.
references:
  - https://thehackernews.com/2026/07/north-korean-hackers-publish-108.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.persistence
  - attack.t1176
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\chrome.exe'
    CommandLine|contains:
      - '--load-extension='
      - '--enable-easy-off-store-extension-install'
  filter_paths:
    CommandLine|contains:
      - '%LOCALAPPDATA%\Google\Chrome\User Data'
      - '%PROGRAMFILES%\Google\Chrome'
  condition: selection and not filter_paths
falsepositives:
  - Developers testing unpacked extensions locally
level: medium
---
title: PolinRider - Package Manager Outbound C2 Traffic
id: 2c3d4e5f-6a7b-8c9d-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects network connections initiated by package manager processes to non-standard ports or IPs, potentially indicating C2 beacons in malicious packages.
references:
  - https://thehackernews.com/2026/07/north-korean-hackers-publish-108.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\node.exe'
      - '\php.exe'
      - '\go.exe'
  filter_standard_ports:
    DestinationPort:
      - 80
      - 443
      - 8080
  condition: selection and not filter_standard_ports
falsepositives:
  - Custom internal registry connections
level: high

// Hunt for suspicious process spawns by package managers
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in ("npm.cmd", "npm.exe", "composer.phar", "go.exe", "node.exe")
| where ProcessFileName in ("cmd.exe", "powershell.exe", "pwsh.exe", "bash.exe", "wsl.exe", "curl.exe", "wget.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, ProcessCommandLine, ProcessFileName, FolderPath
| order by Timestamp desc

-- Hunt for recently modified package. or go.mod files indicating new package additions
SELECT FullPath, Mtime, Size, Mode
FROM glob(globs=["/Users/*/*node_modules/package.", "/home/*/*/node_modules/package.", "/home/*/*/go.mod"])
WHERE Mtime > now() - 7 * 24 * 3600
  AND Size < 10000000
-- Hunt for suspicious Chrome extension directories on Linux/macOS
SELECT FullPath, Mtime
FROM glob(globs=["/home/*/.config/google-chrome/Default/Extensions/*/manifest.", "/Users/*/Library/Application Support/Google/Chrome/Default/Extensions/*/manifest."])
WHERE Mtime > now() - 7 * 24 * 36000

# Audit for recently modified npm package directories (last 7 days)
$Path = "$env:APPDATA\npm"  # Common global npm path
if (Test-Path $Path) {
    Write-Host "Auditing recent npm activity in $Path..."
    Get-ChildItem -Path $Path -Recurse -File -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) } |
    Select-Object FullName, LastWriteTime
}

# Check for unusual Chrome Extensions loaded via Command Line arguments
$chromeProcs = Get-Process chrome -ErrorAction SilentlyContinue
foreach ($proc in $chromeProcs) {
    $cmdLine = (Get-CimInstance Win32_Process -Filter "ProcessId = $($proc.Id)").CommandLine
    if ($cmdLine -match "--load-extension=" -and $cmdLine -match "/Temp/|/Downloads/") {
        Write-Host "WARNING: Suspicious Chrome extension load detected: $cmdLine" -ForegroundColor Red
    }
}