The OpenSourceMalware registry flagged two new malicious npm packages — itsa-react-checkbox (16.0.5) and itsa-utils (1.4.2), both rated critical — linked to the PolinRider campaign, the DPRK supply-chain operation tied to the Lazarus Group and the Contagious Interview/TasksJacker cluster. Importing either package immediately activates an obfuscated multi-stage loader without requiring an npm lifecycle script, matching the campaign's established pattern of config-file injection and install-time execution. Both carry OSV advisories (MAL-2026-18360 and MAL-2026-18363). PolinRider has previously compromised 1,950+ public GitHub repositories across 1,047 owners and has since spread to Go modules, Packagist and Chrome extensions. Engineering teams that installed any affected version should treat the installation environment as compromised and remediate from a clean machine, given the campaign's demonstrated appetite for registry and CI/CD credentials.

• Source article