North Korea's Lazarus-linked hackers have quietly planted 108 malicious packages and Chrome browser extensions across four major software ecosystems — npm, Packagist, Go, and the Chrome Web Store — in an ongoing campaign researchers are calling PolinRider. The packages are still live, new ones are still appearing, and developers who installed any of them in the last few weeks may already be compromised.

What makes PolinRider different is the sheer breadth. Most software supply chain campaigns target a single registry — npm is the usual hunting ground. Spreading across four ecosystems simultaneously, including Go modules and a browser extension store, suggests a more mature, better-resourced operation. The threat actors aren't just dropping packages cold, either: researchers found they're also compromising legitimate maintainer accounts to push malicious updates, which is significantly harder to detect than a typosquatting package with a suspicious name.

This is connected to the Contagious Interview campaign — the same North Korean cluster that has historically posed as tech recruiters, luring developers into fake job interviews before pushing malware disguised as "take-home test" repositories. PolinRider looks like an evolution of that playbook: instead of tricking individual developers one at a time, compromise the package they already use.

Why it matters for defenders is straightforward: your Software Bill of Materials (SBOM) is only as good as the last time you checked it. A package that was clean six months ago may not be clean today if its maintainer account was compromised. Dependency pinning — locking packages to a specific, verified hash rather than a version tag — is one of the few practical defences here, alongside routine checks against databases like OSV and Socket's registry analysis.

The Chrome extension angle is particularly sharp. Extensions run in privileged browser contexts, with access to cookies, session tokens, and in many cases, all page content. A compromised extension distributed through an account takeover carries none of the usual red flags a brand-new extension might.

Australian exposure is real. The Go and npm ecosystems are deeply embedded in the technology stacks of Australian software firms, fintechs, and government digital services teams. The Australian Signals Directorate has previously warned about supply chain compromise as a top-tier threat vector in its annual Cyber Threat Reports, and the Secure Software Supply Chain principles published by ASD's ACSC directly address dependency integrity. Any Australian team with active Go or npm dependencies should be cross-referencing their lock files against the indicators of compromise Researchers have published from this campaign.

What to watch: The researchers who disclosed PolinRider flagged that new packages are likely to keep emerging. This isn't a campaign that has been shut down — it's one that has been identified. The difference matters. Threat actors with this level of persistence tend to shift tactics slightly and continue; expect updated package names and new maintainer account targets in the coming weeks.

The broader lesson isn't new but it keeps not being learned: the supply chain is the attack surface, and treating it as someone else's problem is how incidents happen.