BLOG

The OpenSourceMalware Show #28

Trojanized Claude Code extension from Cursor, Binance and Polymarket thefts, PolinRider backdated to 2025

By cb482791-4ef1-4762-96ad-b0ca4bdd538e ยท

The OpenSourceMalware Show #28

The OpenSourceMalware Show is available on YouTube, LinkedIn, and as a podcast.

The OpenSourceMalware Show #28

This week we talked about:

  • Trojanized Claude Code extension: On October 29, a trojanized Claude Code extension was shipped from Cursor's own mirror of the Open VSX registry. Cursor's mirror can carry different versions than Open VSX itself, so the only people who got it pulled Claude Code through Cursor, and most of them appear to have had auto-update turned on. The extension included the official binary plus code that gives attackers persistent remote access.

  • Binance robbed by North Korea: The $6.3 billion Binance crypto theft started in June, when an engineer downloaded a malicious version of Homebrew. Binance cleaned it up, but the attackers had already learned enough about that engineer and his colleagues to pick their next target. In September a second engineer was compromised through a fake job interview's take-home assignment on a work laptop.. That access led to two more developer machines, and a container deployment token on one of them was used to deploy the container that launched the attack on October 29.

  • Polymarket compromised through DebugBear: Polymarket was compromised through malicious JavaScript from DebugBear, a third-party vendor whose DNS records were hijacked at its domain registrar. Beyond DebugBear's first incident post on X, there's no public information about the attack yet. Injected JavaScript isn't new: it has been a common WordPress incident for years, through sites with an upload function and path traversal.

  • PolinRider backdated to 2025: A set of legitimate npm packages compromised in May 2025 carried an obfuscated payload that turns out to be the earliest known PolinRider infection. The same maintainer was hit again multiple times this year, indicating they were likely compromised the entire time and could be one of the earliest victims.

Resources

[00:00:00] Jenn Gile: Hello. It is Thursday, November 5th. I'm Jenn Gile. I have Paul McCarty with me. We are the co-founders of OpenSourceMalware, and this is the OpenSourceMalware Show, where we talk about the week's malicious open source news. And wow, Paul, do we have a lot to cover today. Just in brief, we're gonna talk about the Claude Code extension, we're gonna talk about Binance, we're gonna pop over to Polymarket for a little bit, and we're gonna talk about PolinRider.

[00:00:28] Jenn Gile: And as we were discussing, my show notes today are like, they're like a novel.

[00:00:35] Paul McCarty: They're like three times lo- four times longer than they normally are, right?

[00:00:39] Jenn Gile: Yeah. Usually they're pretty sketchy and, uh, you know, we make it, but a lot has happened in the last week. Oh my God. And so let's start with last Thursday.

Trojanized Claude Code extension shipped from Cursor's mirror

[00:00:51] Jenn Gile: I was down in Austin. I was kinda getting ready for bed when I get a message from you that says something along the lines of, "Hold onto your pants. Something big is coming." And, uh, to kind of, you know, give everyone an idea of what we were going through last Thursday, my Thursday, your Friday, on October 29th, a community member tipped you off about a trojanized VSIX package.

[00:01:19] Jenn Gile: That's the standard format for VS Code and Open VSX. So it was version 2.1.312 of the official Claude Code VS Code extension. It contained the official binary and also a little treat. Uh, it would give attackers persistent remote access to the machine where it was installed. It didn't actually, um, have an info stealer in it, but it was looking for cloud credentials.

[00:01:45] Jenn Gile: And when we first saw this, we knew it could be really, really bad, but we had like, not a lot of information. And what made this complicated is there's a l- like, um- It's not always clear based on the format where something might have come from and how far it might have spread. And so we were really trying to figure out in those early hours which vendor had been compromised.

[00:02:11] Jenn Gile: You know, was it Claude Code and Anthropic? Was it one of the marketplaces? Like, where did this happen? Was it a third vendor? Um, what we saw was that the official Claude Code packages for the VS Code marketplace, the Open VSX marketplace, and npm, all of those skipped versions straight from 2.1.311 to 2.1.313.

[00:02:38] Jenn Gile: And there were no statements from any of those, uh, platforms- Correction ... including... Oh, sorry. Jump in.

[00:02:45] Paul McCarty: Correction. So yeah, sorry. They skipped from 312, which was the last legitimate version. They skipped to 314. 313 is the one that was missing.

[00:02:56] Jenn Gile: Apologize. Uh, apologies. Yeah. So, uh, there was a version skip. What we were doing, both of us, we were looking at all these marketplaces and trying to see was there malware live somewhere, and all we saw was a skipped version.

[00:03:10] Jenn Gile: There were no statements from any of the vendors, including Anthropic. And so we kinda had to start from the place that a lot of, you know, incident responders would start from, of assuming compromise across all of these. And so what we did was we sent out an alert to our customers, and we posted on social media kind of a quick, "Hey, we don't really know a lot right now except there's a compromised official version out there.

[00:03:38] Jenn Gile: It could have gone out through any of these channels. Immediately look for this version while we try to figure out what's going on." And so, uh, I'll pause there. Like, you were in the meat of this. Tell me what was going on.

[00:03:52] Paul McCarty: Yeah, I was, I mean, it doesn't happen much more real time than how it happened that day.

[00:03:58] Paul McCarty: So I mean, I think the really important thing to start with is that we had the artifacts in our hands, right? So like we got from the victim, we got the 3.1.3, um, version of, you know, what looked like an Open VSX, um, uh, extension. So we had it, um, and we knew that, um, the, you know, for all intents and purposes, it was the same thing as 3.1.2 because we, it was easy for us to compare it against the, the earlier version and to see that it had this, um, you know, additional file that, that, you know, where the, the payload was.

[00:04:36] Paul McCarty: Um, so I think that's the important thing to start with is that we had it. So we were looking at an Open VSX. It, I mean, it was an Open VSX, uh, package at the time. And, you know, I, I'll jump right in here. I think at the time, um, you know, like you said, there was no information, and this happens all the time.

[00:04:54] Paul McCarty: When we find something new, um, you know, you're out there on your own kind of trying to figure this out and do research, and you're dealing with a victim and you're g- getting victim accounts. Um, and that's the other thing too, is that the victim was saying it was Op- you know, they got it from Open VSX. So, you know, at that point it was a, it was a done deal.

[00:05:14] Paul McCarty: It was, it was an Open VSX, and it was, it just wasn't from the main Open VSX.

[00:05:19] Jenn Gile: Um, and by the way- Well, yeah, so to explain, we were able to- Yeah ... eliminate some sources. So we determined it was not pushed through the VS Code marketplace. We determined it was not pushed through the NPM marketplace. And so based on the information you had, we determined, okay, it looks like it came from the Open VSX marketplace.

[00:05:41] Jenn Gile: That's what we're gonna share out with people. And then things got even more interesting. Um, what can you share about the back channels? I don't wanna, uh, say anything that I, will get me in trouble.

[00:05:54] Paul McCarty: Yeah. Well, I wanna do the same thing, so I'm gonna be very, um- Uh, I'm gonna, I'm gonna choose my words very carefully.

[00:06:01] Paul McCarty: Yeah, so basically at that point we were the only blog out there, um, talking about this. We were the only researchers that knew about this. You know, all the other big companies worth a billion dollars had no clue. Um, so, uh, what happened is a friend reached out, um, and, and act- and this happens all the time.

[00:06:19] Paul McCarty: Like I do disclosure constantly, and this happens all the time. I will often be reaching out to somebody that I know is an intermediary. In this case it went the other o- the other direction. Somebody reached out to me, uh, put me in contact with the Cursor team, and one of the founders of, of Cursor, uh, gave me a call and we had like a little mini, um, you know, kind of incident response kind of, um, uh, you know, chat about what was going on.

[00:06:48] Paul McCarty: Basically there... And, and none of this is like, you know, I haven't signed any NDA and, and you know, I mean, we can talk about this pretty openly, but the, basically what they asked me was You know, where have you seen this? And I said, "Well, at this point all I have is this Open VSX extension. We, you know, we- we're pretty sure this never hit NPM, um, or the Mic- the Microsoft VS Code marketplace either."

[00:07:10] Paul McCarty: Um, and, uh, Cursor said, "Okay, so you've only seen it in Open VSX?" And yeah, like, d- did you, do you, were you able to download the package from Open VSX? And I said, "No, I, I was not." Um, now the problem is we had all these kind of artifacts coming in from different, you know, victims, and, you know, we're trying, you and I are trying to manage all this, right, in real time, uh, you know, when we're o- on opposite sides of the world from each other, which is always fun.

[00:07:37] Paul McCarty: But, um, they basically, uh, Cursor, uh, then said, "Hey, we think this is actually from us." And then they started talking about theirs. Now, up until this point, I didn't realize that Cursor had a separate Open VSX mirror. You know, some other people like Rafael, for example, at, at Aikido, um, who you had lunch with recently, right?

[00:07:59] Paul McCarty: Yeah. Great guy. Um, uh, kn- knew that. So other people understood that kind of relationship better than I did. But yeah, Cursor then, um, explained that, um, they had their own Open VSX mirror, and that, and they also alluded to the fact that it did some interesting things, right? And in the meantime- Mm-hmm ... you know, I have agents working in the background, and I'm getting stuff coming in from some of our other friends.

[00:08:24] Paul McCarty: Right. You know, it, all, everything's all really, really fluid. But I think the important thing to note here is that Cursor was looking from me to identify whether or not I had actually found it in other places. So I think they didn't, they weren't 100% sure it was inside of their organization yet, and I don't think they understood how it got there at that point.

[00:08:42] Paul McCarty: Um, so you know, when I said- Yeah ... "Hey, you know, everything we're hearing is Open VSX," they said to me, "Well, we think it's Cursor." And I said, "Well, hey, listen, I've got some of the victims on the phone right now. Let me just reach out to them and ask." And so I went through the incident responder, and I said, "Hey, can you ask the victims directly?

[00:08:59] Paul McCarty: They kept saying Open VSX, but can you verify if they, it was Open VSX or for Cursor?" And then really quickly I got updated details which were saying, no, this was Cursor auto-updates versus Cursor. At least one people saw it, one person saw it happen. And, you know, that's when things started to change. Our frame of reference at that point changed.

[00:09:20] Jenn Gile: Yeah. So like, to clarify for anyone who has... Uh, like I feel like the Always Sunny Philadelphia Charlie meme where he's like pointing in five different directions and like looks crazy. Um- Uh, their, Cursor maintains a limited mirror of the Open VSX registry, which contains or can contain, in this case, separate, um, versions from what's actually in Open VSX.

[00:09:52] Jenn Gile: So- Right ... the only way you would've consumed this extension would be, number one, if you use Cursor specifically to pull a Claude Code extension. So you're not getting that extension from somewhere else, you're consuming it directly through Cursor's, uh, ecosystem. Right. And number two, if you had the auto-update enabled.

[00:10:18] Jenn Gile: I mean, granted, somebody could have, uh, manually, you know, chosen to get the malicious version, but it wasn't up a super long time. And so from what we understand, most of the people who were affected had auto-update turned on in their Cursor extension library. Yeah.

[00:10:40] Paul McCarty: Yeah. Correct. Um,

[00:10:43] Jenn Gile: yeah, so- And Paul, I'm gonna pause you from a s- for a second.

[00:10:45] Jenn Gile: We've got somebody on YouTube saying there's a little bit of mic feedback, so make sure you don't turn your head away.

[00:10:51] Paul McCarty: Got it. Okay. I will laser focus on my microphone.

[00:10:54] Jenn Gile: I know. So anything else, uh, we wanna talk about with regard to this, uh, trojanized extension?

[00:11:06] Paul McCarty: Um, I think that the important thing, you were touching on it there, um, before we s- we made that change, is that there are two, um, there's two, uh, kind of internal ways that Cursor will feed out extensions to their users.

[00:11:24] Paul McCarty: One of them is that they will effectively proxy Open VSX. The other is that they have a set of internal, um, packages, sorry, extensions that they will feed out. And th- those internal, I, I enumerated, um, a whole bunch of them, um, and I found, uh, I think 12 that, in particular, that are strange. Um, which, you know, I'm putting this all in a blog post soon.

[00:11:48] Paul McCarty: But I think the thing that's important to understand here is that inside of their system, if you ask for, "Hey, let me ask for Gen, you know, extension version 1.0.0," it'll go to this internal service which is called Gallery, and then Gallery will, will decide, "Where do I get this actual extension from? Do I get it from our Open VSX mirror or do I get it from this package repository?"

[00:12:10] Paul McCarty: And there's logic there that'll tell them which things happen. Now, there's a whole bunch of other logic there that does some weird stuff too as well. So for example, Cursor was originally o- owned by a company called Anysphere. And there are rules inside of the c- the Cursor Gallery service that says, "Hey, if you ask for an AnySphir- Anysphere service, guess what?

[00:12:29] Paul McCarty: Don't check it with your, your, your firewa- sorry, your, um, your malware scanning." And there's all kinds of this other kind of weird stuff. Oh,

[00:12:35] Jenn Gile: interesting. I didn't-

[00:12:37] Paul McCarty: Yeah ...

[00:12:37] Jenn Gile: catch that one. Huh.

[00:12:39] Paul McCarty: No, yeah. I mean, I, the, the, I haven't pushed the blog post yet to the Intel library, but, um, the, there's just a lot of weird stuff going on there, right?

[00:12:47] Paul McCarty: And so they, they built this years ago, and it was feeding out extensions and, you know, then they added the Open VSX mirror thing, and it just all got really- Yeah ... kind of complicated behind the scenes. So another thing they do is they serve out a version of the Microsoft Python, uh, extension that's old.

[00:13:05] Paul McCarty: And they do that specifically because the new version, the official version, is- isn't compatible with the new version of Cur- Cursor, so they're, they're serving out this early 2025 version of the package for if you ask for the, the official Python, um, extension. Interesting. They'll, they'll hand you this old one, even though there's a new one in there.

[00:13:22] Paul McCarty: So they have this logic inside of there that says, "Hey, if a customer asks for the Python extension, this, this Python extension, don't give them the one from Open VSX. Give them this one from our internal storage." I'll, I'll cap it there. There's, there's a lot more that's going on behind the scenes, but w- we'll leave it there.

[00:13:40] Jenn Gile: No, uh, I think- To be

[00:13:41] Paul McCarty: continued ...

[00:13:41] Jenn Gile: uh, the, where we'll leave this is it's easy to, uh- Second guess or Monday morning quarterback or whatever version of that, um, you know, how people handle these. I think we stand by the initial statements about, you know, look for it across all of these ecosystems because in the lack of any statements from any vendors, you know, assume compromise.

[00:14:09] Jenn Gile: I, I would've liked to have seen something from these ecosystems. You know, they intentionally skipped versions and that implies- Yeah ... a choice was made. So, you know, not great, but at the same time I also do understand how corporate, uh, comms and legal requirements tend to work with these kind of statements and they probably didn't wanna put out a statement until they knew what they were saying, 'cause nobody loves an I don't know what's happening statement.

[00:14:45] Jenn Gile: The lawyers don't like it, the comms people don't like it. So I don't know. I see both sides. Don't love how that went down but I also understand it.

[00:14:56] Paul McCarty: Yeah. I'm gonna double click there. I think that Anthropic was definitely involved in this because all of those packages, you know, to skip version 3.1.3 in NPM and VS Code Marketplace and the other places, that was Anthropic, that was not Cursor.

[00:15:09] Paul McCarty: So obviously Cursor was talking behind the scenes to Anthropic, right? Neither one of them said anything until our blog post came out and the, and my assumption is that Cursor would not have made anything, many, made any of this public unless it was for our blog post. In fact, I've actually heard that, you know, explicitly said in the grapevine.

[00:15:28] Paul McCarty: So, um, uh, I, and I am disappointed by the fact that these companies continually do this kind of... Yeah, it just, it's, it's I don't like that the AI companies in particular are not honest and transparent about these kind of security events, because a lot of us are running these tools and we're, you know, we're downloading components inside of these ecosystems, and that fills me with a lot of distrust in these companies, and I'm, I know a lot about...

[00:16:02] Paul McCarty: And that's why this blew up, because a lot of other people have that, feel that same kind of distrust.

[00:16:07] Jenn Gile: Yep. Amen to that. Um, we were talking, you know, throughout this week about what we would do again and what we would do differently. Like I said, I, you know, hindsight being what it is, I would still make the same decision to flag that all of those ecosystems were potentially delivering malware.

[00:16:27] Jenn Gile: Paul, what would you do the same again, and what would you, knowing what you know now, what would you do differently?

[00:16:33] Paul McCarty: Yeah, I mean, I think that there, there were a bunch of, I'm gonna be a little spicy here. There was a bunch of arm- armchair quarterbacks coming from other companies who didn't have this, right?

[00:16:40] Paul McCarty: And so, um, sucks to be them. But, um, the, the reality is that I, there are some things that I would do differently. Um, I think in particular, when you're, when you're in the incident response mode and you're trying to, you know, you're trying to work through this, you're getting a lot of data coming in from a lot of different sources, right?

[00:16:58] Paul McCarty: And you're trying to figure out how much of that is true and how much of that is true and how much of that is true, and you're kind of putting this together into this kind of, you know, this narrative, right? And it's very disjointed. I think sometimes my inclination personally, having done incident response for 30-plus years, all right, so please, like, all these, all these people new to the industry, please, I, I've been doing this for a while.

[00:17:22] Paul McCarty: And the reality is that it's my job, people use OSM to tell them when something's malicious, and it's my job to make sure that we try to protect them as much as we can. And in that moment, the thing that I would do different is probably I would've held back a little bit longer on, you know, making some of those kind of judgments about, um, NPM or otherwise.

[00:17:43] Paul McCarty: But at that point, we thought we were, you know, protecting our customers, and we were. And so to, to be very explicit, I would absolutely do the same thing again. If I see a missing version of NPM 3.3, you know, or VS Code extension, I would do exactly what I did, which by the way is I said, "Hey, listen, these versions are missing.

[00:18:04] Paul McCarty: They're presumed malicious, but we don't actually have data. We have not inspected." We always said that, so there's always these big qualifications around it. So I would absolutely 100% do all that again. It's my job to help, to help people make sure that they don't ingest malicious stuff into their, uh, into their applications and their environments and, and that was part of that.

[00:18:25] Jenn Gile: Yep. Yeah. Hard decisions to make. Definitely no fun, uh, making those decisions under time pressure. Like, it is what it is

[00:18:36] Paul McCarty: Agreed.

Binance robbed by North Korea

[00:18:36] Jenn Gile: Okay. Let's move on to the other huge news story. This is one that we were not at all involved in, and so, uh, this is something where I'm gonna, uh, talk about what happened and then let's kinda analyze it.

[00:18:52] Jenn Gile: So unless you've been living under a rock, you've heard that Binance, uh, got hit. It is being called the biggest bank robbery in history. I didn't validate that particular claim, but it's certainly the biggest crypto theft in history. Attackers stole $6.3 billion in crypto, or at least that's what they tried to steal.

[00:19:15] Jenn Gile: Roughly 3 billion of it was frozen by, uh, Tether and Circle, and so they may not have been able to make off with the full amount. There's a lot happening right now to try to recover those stolen funds. Um, but immediately, rumors started spreading that it was related to a compromised developer, and very quickly the FBI linked it to North Korea because it shared infrastructure with the Bybit attack which happened earlier this year.

[00:19:44] Jenn Gile: Very similar, um, shape to it. Um, like we've seen with other attacks, reusing infrastructure is not uncommon. Um, these are not things that are constantly firing, and if this is infrastructure that, uh, can't get shut down, then it doesn't, you know, there's not a lot you can do about it. So that's all the, you know, setup to this.

[00:20:08] Jenn Gile: On November 3rd, Binance released a, um, kind of a retrospective, a statement about the compromise, and I think generally they did a nice job with this. They definitely admitted that they, uh, failed, uh, that there were failure points. I know, you would always like to see more. Um, but they- Oh, I'm gonna talk about it.

[00:20:30] Jenn Gile: I know we are. Um, but they separated it into both how the attack itself played out, as well as the kinda like building blocks that the attackers had in place. And so I'm gonna start there 'cause, um, I don't know, I'm biased. That's always the part that I find most interesting. Um, so this started in June of 2026 with one of their engineers, um, doing a, a browser search for Homebrew.

[00:21:01] Jenn Gile: Didn't really pay attention to where they were downloading it from, downloaded a malicious version. Um, it seems, according to Binance, that they detected that very quickly, cleaned everything up. However, uh, it triggered for long enough that the attacker was able to get some information about what that engineer did and his colleagues.

[00:21:25] Jenn Gile: And so this, you know, whether that, uh, that was not a, like, targeted attack. This was- Certainly luck on the part of the threat actor that a, an engineer clicked a bad link. However, what they did say is throughout the year, they have detected and prevented, they said 57 suspected North Korean-linked cyber threat cases that span the gamut of all the stuff you and I have been talking about on this podcast.

[00:21:55] Jenn Gile: Fake job interviews, uh, malicious software, uh, compromised packages and browser extensions, fake video conferencing applications, social engineering campaigns. Like, Binance has been getting hit all year, which is no surprise, um, to us given, you know, they do crypto and it's a, a great target if you're a threat actor.

[00:22:18] Jenn Gile: Uh, fast-forward to September, they evidently used that information that they got from their, uh, lucky attack. What do they say? Luck favors the prepared. Uh, so they got enough information to figure out which engineers to target with the social engineering component of the scam. And so the next engineer gets hit with what we know as Contagious Interview.

[00:22:43] Jenn Gile: They didn't describe it that way in their incident report, but from reading through it, it's very obvious that's what it was. And we've kind of heard some, again, uh, chatter from circles that confirms that's what it was. Um, but somebody reached out to the engineer, uh, offered them a job interview. They went through multiple loops.

[00:23:03] Jenn Gile: Uh, they were shown lots of things to raise their trust in the process that they were in a legitimate interview process. The trust raised enough that when they were given a take-home code assignment, they went ahead and completed that. Not only did they complete it, but they completed it on their work laptop, which, uh, goes to show Yeah.

[00:23:28] Jenn Gile: It happens. It happens more than we want to admit. Um, but that take-home code assignment was a repository that contained malicious code. And, um, we don't have a lot of detail on exactly what it was, but in reading through the components that they describe, it sounds very much like the classic kill chain that we've been documenting all year.

[00:23:53] Jenn Gile: Uh, it had a component that, um, replaced the pyenv with a malicious version, which we've seen that same pattern with them replacing the npm CLI with a malicious version. I can almost guarantee that this, um, person had the PolinRider campaign on their machine, very likely passed it around. Uh, but Binance says their endpoint detections didn't pick up any of this activity, which tracks with what we've seen.

[00:24:24] Jenn Gile: EDR cannot catch this type of attack because it's not anomalous behavior, it's normal software engineering behavior. And so they didn't say specifically when this happened in September, but it sounds like the attackers had access for well over a month before they started making some moves. So on the 20th, they were able to use that compromised engineer to get access to two other developer machines.

[00:24:54] Jenn Gile: One of those developers had a container deployment permission token on their computer. And then on the 29th, so also last Thursday, last Thursday was a busy day, um, they used that credential to, um- Remote access deploy a container, and that container triggered a malicious script, which launched the attack.

[00:25:16] Jenn Gile: Oof. So that's just the setup. Like, we didn't even talk about the attack. Um, this has been an interesting one to track, huh, Paul?

[00:25:24] Paul McCarty: It, it has. Um, meanwhile, SEAL Alliance came out with, um, a really good article talking about, um, the Binance hack and the difference between, Contagious Interview and TraderTraitor.

[00:25:39] Paul McCarty: And I think that is an important thing to highlight here, because as of yet, there's no evidence that PolinRider was involved in, um, you know, in this Binance attack. But if PolinRider was on one or some end number of Binance laptops, that gives DPRK the ability, 'cause they've got persistence and visibility on th- these laptops, the ability to do, you know, enumeration and figure out, "Oh, who is it here that we wanna specifically target inside of this organization?"

[00:26:10] Paul McCarty: But not knowing if PolinRider's on there or not, I think it's important to talk about the, the, the tools they use. So this py, um, env, um, uh, attack component they used is not part of the typical, um, PolinRider and, and Contagious Interview toolkit. This is a different- Yeah, and

[00:26:30] Jenn Gile: I wonder if that was, like, a little bit of a custom thing, given they had some intel on what Binance was using.

[00:26:37] Paul McCarty: Well, I think this is one of the distinctions that SEAL is making between Contagious Interview and TraderTraitor in the sense that- Mm-hmm ... that, you know, like, whether... Like, we, we used to talk about BlueNoroff, and now we're talking about TraderTraitor. But in both those cases, the idea is that at some point it's passed off from You know, these lower teams, the B team to the A team- Yeah

[00:26:57] Paul McCarty: and then the A team has the skill on their team to be able to customize some of this stuff. Or at least pull out tools that, you know, and they're not just throwing at everything like they are with the common kind of PolinRider stuff. Like we, you know, we, we've mapped dozens and dozens and dozens of campaign IDs, um, and the fingerprints for each one of those for the PolinRider stuff.

[00:27:20] Paul McCarty: Um, so we'll pick up on that quickly. So it makes sense that they would use, even if it's not s- genuinely custom for this one-off, at least a toolkit that you don't see, that they only pull out for specific, um, kind of more, you know, one-on-one customized attacks.

[00:27:35] Jenn Gile: Yeah. Well, I mean, the takeaway here, uh, that I think you left in the show notes is that one developer led to the largest crypto heist in history.

[00:27:45] Jenn Gile: Um, my takeaway is it has been challenging to help people understand how malicious open source is just as, if not more threatening than your classic ransomware. Because r- Mm-hmm ... people really pay attention to ransomware. They think about that dollar figure. So I guess my hope is that people learn from this and can see the real dollar outcome that can happen, and can perhaps then take a little bit of a leap and say, "Okay, we don't, we don't have crypto on our platform, but we do have things that are worth something that this kind of an attack could make possible to exfiltrate."

[00:28:28] Paul McCarty: Yeah. One thing I just wanna double-click, too, is you, you briefly highlighted it, but I think, um, Binance's timeline is good in some places and pretty crap in other places. Um, so for example, and I know other people have talked about, like, like for example, on the Risky Biz podcast they were talking about this, but I agree with them.

[00:28:46] Paul McCarty: You know, after it gets to that, um, that component where they get access to the, the first developer's laptop via Contagious Interview/TraderTraitor- Yeah ... then it gets kind of muddy about what happens next, and they don't go to, into any detail whatsoever. And I think one of the things that's, that that means is that when people are talking about this attack, people are saying, "Oh, it's very simple.

[00:29:09] Paul McCarty: You know, relative to the, the Bitget attack, this is relatively simple." And I think some of the complexity that has probably happened in this attack is getting lost because Binance hasn't gone into detail about it, right? So right now it just, uh, I j- hey, Binance, by the way, what's happening is the narrative out there is that you had a developer that got popped during Contagious Interview and then $6 billion left your organization.

[00:29:31] Paul McCarty: So I think it behooves you to go into a little bit more detail about what happened after that initial Contagious Interview/TraderTraitor compromise, because that'll help us understand the narrative better. 'Cause right now people are oversimplifying it, and I don't think that's good for anybody. It's not good for Binance, and it's not good for us, the ecosystem.

Polymarket compromised through DebugBear

[00:29:49] Jenn Gile: Yeah, well said. Okay, in brief, I think it's worth talking about Polymarket because it happened- Mm ... basically the same day, and so there was a lot of- Uh, assumptions that it could have been the same threat actor, that this was a coordinated attack. I'm gonna say based on what I've seen, I don't think they're linked.

[00:30:10] Jenn Gile: I'm not saying it's not possible, but essentially what happened is, um, Polymarket was also compromised last week. It actually came through one of their providers, their tools, DebugBear. DebugBear had been compromised through its DNS server records. Uh, rather its DNS server records were compromised through its domain registrar, which to all my friends who say it's always DNS, it's always...

[00:30:36] Jenn Gile: It was DNS. Um, there's really no- It's not

[00:30:39] Paul McCarty: always DNS, but it's always DNS.

[00:30:41] Jenn Gile: Yeah, exactly. If it's not that, it's secrets. Um, so yeah, we don't have any other information. This is quite the void of what's happened. I looked around before our, um, recording today, couldn't find any statements from DebugBear other than the initial, "Hey, we're going through an incident," uh, thing on X.

[00:31:00] Jenn Gile: I don't know, Paul, have you seen any more than that?

[00:31:04] Paul McCarty: I mean, I think it... You know, we're, we're not gonna go into a lot of detail just because of time, but I, I think this DebugBear attack is a sign of things to come. Now, this is, this has been swept into the dustbin of history because it's only $6.7 million or whatever ridiculous...

[00:31:21] Paul McCarty: You know, when you're talking about- Yeah ... you know, the, the, the Binance hack at 6 billion, this is nothing compared to that. But injection of these malicious JavaScript components from a trusted third-party vendor, let me tell everybody, this attack is gonna be, you know, if I'm gonna call it the, the 2027, like this is gonna become much more popular in 2027.

[00:31:45] Paul McCarty: Um, what do you think the bad guys are doing right now with all those, the haul of credentials they've, they've gotten from GhostAction and TeamPCP and all that? What do you think they're doing with it right now? Right? They're gonna use it to build stuff like this in all kinds of small little companies all over the place.

[00:32:02] Paul McCarty: Um, and you know, it's, it's gonna be crazy. Yeah. Injected JavaScript from a trusted third party, I'm calling it now.

[00:32:09] Jenn Gile: I have people reach out all the time, and I had an exchange earlier this week about, you know, the overlap of our area of research and our threat intel with ransomware and things like that, and I was telling them, "You know, we don't really see a lot of ransomware."

[00:32:27] Jenn Gile: And here's more kind of like the reason that I would say that is as opposed to fact, and Paul, I think you kind of went there with this, is- Sure. There's a lot of data being collected that you could cash in on and try to get paid by each company that you stole it from. But a lot of this stuff can be quickly rotated.

[00:32:50] Jenn Gile: You know, if you're stealing credentials, maybe you couldn't get to the data you wanted, and you may get more out of it if you use it as a cascading software supply chain attack, much like what happened with Trivy earlier this year, than if you go and try to extort each victim. And I think that's really, you know, what we see here

[00:33:15] Paul McCarty: Yeah, agreed.

[00:33:16] Paul McCarty: And I think that, you know, we- we're gonna say the same thing, which is like AI just makes so much more of this so much more capable. Like w- something that we're seeing at a very high level is that relatively low maturity threat actors can use AI to build the shape of things. You know, a really good example is GhostAction.

[00:33:35] Paul McCarty: You know, they're building their payloads and their attacks around the shape of DPRK TTPs. Now, GhostAction is not DPRK, but they happened, for whatever reason, copy the exact payload path name of a fake font file from DPRK to put their payload in. Payload has nothing to do, it's totally dissimilar from the DPRK one, but my point in bringing all this up is to say low maturity or, or non-technical threat actors using AI can use the shape of things and then kinda customize their own payloads and their own kind of attack structure around that.

[00:34:09] Paul McCarty: And I think we're gonna see that now with these injected, you know, third-party JavaScript. By the way, this attack has been around, I've been dealing with this in WordPress incident response for years, where basically, you know, WordPress-

[00:34:22] Jenn Gile: Oh, the DebugBear thing? Yeah.

[00:34:23] Paul McCarty: Yeah. Well, just, yeah, you just like injected, injected JavaScript, right?

[00:34:27] Paul McCarty: Like you, you find, you find a WordPress site or a Drupal site that has an upload function and path traversal, and you use those two things together. You pop the, the... I mean, I literally have been dealing with that for, I don't know, 10, 15, I don't know, a long time. And so this idea that now people are gonna take that and they're gonna actually embed that in third party, so they compromise somebody like a PostHog or they compromise...

[00:34:48] Paul McCarty: And I'm not saying PostHog has been compromised. Mm-hmm. I'm just saying somebody like that- Like that ... that everybody uses, and then they inject JavaScript into your web app directly, boom. You know, it's like death kiss.

[00:35:00] Jenn Gile: Yeah.

[00:35:00] Paul McCarty: I don't know.

PolinRider backdated to 2025

[00:35:01] Jenn Gile: All right. Now, uh, our last topic today, uh, would have been the headline for this had it happened at any other time.

[00:35:11] Jenn Gile: You and I were working on this, you know, Wednesday, Thursday last week, and then all of a sudden everything went sideways. So, uh, you were poking around at a compromised package that NPM had removed, what, ages ago. Uh, this- I think so,

[00:35:29] Paul McCarty: yeah ...

[00:35:29] Jenn Gile: yeah, predates, uh- It's all blended into

[00:35:31] Paul McCarty: the background. Who knows?

[00:35:32] Jenn Gile: Yeah. It predates, um, OpenSourceMalware's existence, to tell you how old this is. Not that we're, like, really old, but, you know. Uh, it gives you an idea. This is not, like, a current thing. But you were poking around and you said, "Huh, the shape of this looks like something familiar." So this was an NPM package from a legitimate maintainer where a single version had been compromised with an obfuscated JavaScript payload that looked an awful lot like PolinRider, and you did some digging.

[00:36:04] Jenn Gile: We both kind of played around in packages in GitHub. It was a maintainer who had all of their stuff compromised and, um, I'm gonna call this a precursor or a building block to PolinRider rather than saying, you know, definitively this was PolinRider in May 2025. But it is absolutely the shape of the payload that we see the PolinRider campaign force pushing into files, right?

[00:36:34] Paul McCarty: I'm gonna go further. I'm gonna say this is PolinRider. I'm gonna say this is-

[00:36:38] Jenn Gile: Gosh. Ooh, okay. So what makes it PolinRider- I'm, I'm gonna say this is def- ... if it's, if it's missing a force push from the dev machine, and if it's missing a bunch of other components, what... how do we differentiate- ... a piece of malware from a campaign?

[00:36:53] Paul McCarty: That's a great question, and I was thinking about this before you said it. All right, so does it have everything that the modern PolinRider has? No, it doesn't. And I think that's something else too. Somebody else months ago pointed out, um, one of the Isaacs pointed out that, "Hey, we saw PolinRider in, in September of 2025."

[00:37:10] Paul McCarty: And I responded back to that. I was like, "No, you didn't. You saw EtherHiding." Right? And EtherHiding is just one component of this whole packaging campaign and threat attack structure that has become PolinRider, right? So to your question, it's missing a few things, but I think overall the combination of what is there is absolutely the first version of PolinRider.

[00:37:33] Paul McCarty: And-

[00:37:34] Jenn Gile: Yeah, that's fair. Because the way that the malware works is very similar. The delivery mechanism is different. This was not a forked repo that, you know- No ... carried it over.

[00:37:47] Paul McCarty: But it was an account takeover. I mean, it was a- Yes ... compromise, right? So, and we don't... And because we don't, because it was so long ago, we don't actually have...

[00:37:57] Paul McCarty: One of the reasons I don't know for sure this is PolinRider is because the API I typically call in, in GitHub ages out after 90 days, right? So I just can't get this information. So the reality is that there could be force pushes there that we just don't know about because they're gone, they're, they're wiped away in the history of the API event log.

[00:38:13] Paul McCarty: Um, but, um, the reality is that it was absolutely an account compromise, so without the evidence of the force push, we have that component. We just don't know for sure if it was that commit component. So I think taking all those things together, the fact that there's a campaign marker and it's an early campaign marker, right?

[00:38:32] Paul McCarty: And just the whole thing kind of blows my mind, because in my worldview, right, like PolinRider as a fully fledged thing, you know, and it's evolved a ton since then, really came into existence in, in late January or early February 2026, this is a relatively recent thing, as a complete package. Mm-hmm.

[00:38:53] Paul McCarty: EtherHiding existed before. Force pushes by DPRK existed before, but putting it all together. Here we go. Here's a package from, what, May of 2025, and I'm just... it's blowing my mind. I'm like, it's, it just resets. You know, it's like when we realized that humans have actually been in Australia much longer than we thought they were, right?

[00:39:13] Paul McCarty: 'Cause the bridge and all that disappeared and all that. Like, it just, it resets the fossil history and the archaeological evidence. Um, and so then that means, well, actually, if it existed in May- I can look for some of these things earlier and we were missing some of these tools that we now use Well, for

[00:39:29] Jenn Gile: example, one thing you were able to trace back was although the package was from May, some of the infrastructure was even older.

[00:39:36] Paul McCarty: Exactly. Exactly. February of 2025.

[00:39:41] Jenn Gile: Yeah.

[00:39:41] Paul McCarty: Um, yeah, so it just, it's just... I mean, I'm, I'm gonna be honest, I'm a bit verklempt. Like, I... It's, it's blown my mind a bit. Mm-hmm. Um, and it's made me question some of those things that, you know, I, I thought were absolute timeline things, pins in a timeline. Uh, clearly they're not.

[00:40:03] Jenn Gile: Yeah. Well, and this particular developer remained compromised, got re-compromised, not totally clear again because we can't see the total history. But we see in 2026, multiple force pushes, evidence of this developer trying to kick PolinRider out of their repos. So, like, the, the modern version, we'll call it that.

[00:40:26] Jenn Gile: The prehistoric version hit them in 2025. The modern version hit them multiple times this year. So I... My hypothesis, which I think is strongly supported, is this person has been compromised since at least May, probably consistently. Right. But that was a, like, maybe experimental phase, and then the threat actor kind of figured out their playbook and really launched it- You know, in early 2026, and that's the evidence that we see in their repo in 2026.

[00:40:59] Paul McCarty: Yeah. And, and, you know, as an observation for, for the threat hunters out there and the incident responders, when you find one of these super early events that sits outside of your kind of known timeline, it's really important, as Jenn points out, to really kind of look at that initial, uh, activity, because this is like a lighthouse event.

[00:41:15] Paul McCarty: What DPRK was doing with this threat actor... Sorry, with this compromised victim, you know, you can, you can see how, uh, the, this is the beginning of something that has now, you know, tens of thousands of, of repositories. So being able to tie that back and understanding that kind of evolution, that- that's very, very helpful for me, right?

[00:41:36] Paul McCarty: Um, and, and I think it should also be noted for other threat hunters and incident responders, if you get that whole timeline, if you understand how it evolved. And like a real evolutionary chain, there's like little branches, right? I mean, we see PolinRider do all kinds of weird stuff. Their obfuscation's constantly kind of evolving and morphing.

[00:41:52] Paul McCarty: Um, and right now, for, for... I'm, I'm even scared to say this in case they're listening, but right now, the obfuscation mechanism they're using is exposing the initial, uh, blockchain, the Ethereum blockchain address. So you can now search for the blockchain, and they're using two or three new blockchain, uh, uh, Ethereum addresses, and it's not, they're not obfuscating that.

[00:42:12] Paul McCarty: So it's clearly the, right there in the PolinRider payload. So, um, yeah. Been interesting.

[00:42:18] Jenn Gile: Well, I'm gonna share one more thing that I haven't even told you about yet. So, um, one of the GitHub community conversations that we participate in where people are kind of trading, "Hey, I got compromised. What do I do?"

[00:42:32] Jenn Gile: Um, I got an alert the other day that someone had shared a whole bunch of, um- Like, uh, search strings. And I looked at them and I was like, "Oh, those are really old. Like, don't use those. You're not gonna find the current stuff if you search by those." I kind of gave them some pointers. Um, but this is like the re-reminder that there's certain things that change frequently, and lately have been changing more and more frequently.

[00:43:00] Jenn Gile: Those things include the filename, the file ending, and the file location.

[00:43:07] Paul McCarty: Yeah.

[00:43:07] Jenn Gile: Don't waste your time setting detections on those unless you're explicitly trying to, like, see how things are evolving. Yeah. Um, set your detections based on things that are much harder to change, the campaign markers- Mm-hmm

[00:43:22] Jenn Gile: the wallets, et cetera. You know, it's funny, I was, um, prepping with our friend Josh from Feedly the other day 'cause I'm gonna do a webinar with him next month, and he's like, "Oh, show me what you're gonna demo." And so I... The thing I'm gonna demo is, um, you know, you can use our free data to pull up, um, a sample of a compromised repo, and then use that to go to GitHub, look at the sample, and start, you know, writing your own detections.

[00:43:49] Jenn Gile: And so I was showing him how I would do that, and I popped into that repo and I was like, "Uh-oh. This is not what I documented last week." Uh- Mm-hmm ... since last week, the threat actor had gone in and pushed a new version out with a new filename, file ending of, I think it's .orc. I don't even know what that is.

[00:44:09] Jenn Gile: It's not a font file. Um, but yeah, it was like a real live example of how had I been searching for the- Right ... WOFF2 example, never would have found it. Never would have known- Yeah ... that another evolution had happened

[00:44:27] Paul McCarty: Yeah, if you're looking, if, s- to Jenn's point, just to go a little bit technically, ch- 'cause she's alluded to it, if you're looking for the WOFF2, you're not gonna find the new stuff.

[00:44:35] Paul McCarty: And if you're looking just in public/fonts, you might not find it as well, because now they're burying the fonts directory in other places. Same thing even with the, the tasks, uh, uh, tasks.json now, I've noticed they've started putting that, and we're burying it inside of custom areas inside of the repository.

[00:44:54] Paul McCarty: Hmm. I

[00:44:54] Jenn Gile: mean, it makes sense, 'cause it takes about two seconds to look at a repo and see, oh, I see a VS Code and a public fonts folder top level of this repo, it's compromised. So they're figuring

[00:45:05] Paul McCarty: that out. Yeah, here- here's your, here's your simplest detection. Does tasks.json exist? And if so, does it have inside of content run on folder open, right?

[00:45:16] Paul McCarty: Yeah. If it has those two, you wanna take a look at it. Um- And

[00:45:19] Jenn Gile: it might not be malware, but also you probably don't want it, you know? Yeah, that's, that's- I've found a few samples where it's legitimate, but turn that off.

[00:45:29] Paul McCarty: Well, and also when you're looking and then you think this is legitimate, like a developer actually did this, and do they really understand what this opens themselves up to?

[00:45:36] Paul McCarty: Because they've enabled, they've obviously, you know, they've re-enabled what Microsoft turned off in February, which is disabling, um, auto tasks run by default. They're turning it back on, and they're, you know, they're running commands and doing all kinds of stuff. Like, you see why tasks, why VS Code tasks is still, like DPRK preferred, even, like after all this time, it's still delivering for them.

[00:46:00] Paul McCarty: Um, so you know, DPRK loves Microsoft VS Code.

[00:46:04] Jenn Gile: Okay. Uh, I'm gonna end us on a teaser. I'm very excited. Uh, we don't do guests very often on this podcast, but we, uh, have a guest lined up for next week. They are the maintainer of two major projects that got compromised this year. And so, uh, Jared Wray is gonna come on and talk about his experience with, uh, keyv and cacheable getting compromised, well his account was compromised, and what he's done as a, you know, professional maintainer since then.

[00:46:38] Jenn Gile: So I think it's gonna be super interesting. It's gonna be different than what we normally talk about, but I really believe the community needs to be exposed to what developers go through when, uh, a project of theirs is compromised.

[00:46:52] Paul McCarty: Totally agree. I'm looking forward to it and, and I'm hoping that it goes a little bit longer than our normal ones, like today.

[00:46:56] Paul McCarty: Today's gone long, but- Yeah ...

[00:46:57] Jenn Gile: um. I think it'll go a little long. Anyway- Yeah. Hopefully ... uh, good talk. Have a great weekend everyone.

[00:47:03] Paul McCarty: Thanks guys. Appreciate you listening. Cheers.