Sunday 05 July 2026 18:07:07 GMT+02:00
Netcrook
#PolinRider
108 Poisoned Builds, One Shared Trap: The New Cross-Ecosystem Supply-Chain Wave
A campaign tied to PolinRider has put malicious packages and browser extensions into npm, Packagist, Go, and Google Chrome, showing how one delivery pattern can travel across very different trust systems.
When a Dependency Update Becomes the Doorway: PolinRider and the Open-Source Trust Trap
A supply-chain campaign tied to PolinRider shows how package ecosystems can turn routine development work into a high-risk execution path.
Trusted Release Keys Turned Into a Supply-Chain Weapon
A maintainer-account takeover can do more damage than a single malicious file, especially when one publish pipeline reaches several software ecosystems at once.