OpenSourceMalware attributes PolinRider to a DPRK-linked actor connected to Lazarus activity, Contagious Interview, and TasksJacker, with confirmed infections across 1,951 public GitHub repositories and 1,047 owners as of April 11, 2026. The campaign appended obfuscated JavaScript to real project configuration files and expanded into multiple vectors, including .vscode/tasks.json curl-to-shell payloads, malicious npm dependencies, fake .woff2 font execution, and propagation scripts that amended and force-pushed Git commits while preserving prior metadata. The report ties the activity to developer supply-chain compromise through infected open-source projects, weaponized take-home tests such as ShoeVista and StakingGame, and Vercel-hosted C2 subdomains including default-configuration.vercel.app. The scale and reinfection evidence show an active operation against developers and downstream users rather than isolated repository defacement.