North Korean Hackers Compromise Go and PHP Packages
North Korean hackers have compromised legitimate-looking Go and PHP open-source packages, known as the "PolinRider" campaign, to distribute malware. The attackers maintain persistent access by updating packages with malicious code even after initial security reviews. This supply-chain attack highlights the growing threat of malware hidden in trusted software repositories.
Background
- The article reports that North Korean state-backed hackers (often tracked as Lazarus Group or Kimsuky) have compromised legitimate open-source packages on the Go module mirror (proxy.golang.org) and the PHP Composer (Packagist) registry, inserting malicious code into widely used libraries.
- This is a "supply chain attack" — instead of hacking a company directly, the attackers infect software dependencies that developers download automatically, so anyone using the compromised package becomes a victim. Similar attacks (e.g., SolarWinds, the 2021 Codecov breach) have become a major cybersecurity concern.
- The Go module mirror and Packagist are official distribution backends that most Go and PHP developers trust and use by default, meaning the breach potentially affects thousands of downstream projects.
- "PolinRider" is the malware family name assigned to this campaign; "jumps the fence" refers to the hackers moving from targeting one language ecosystem (e.g., Python/PyPI, where similar attacks were previously seen) into Go and PHP.