North Korea's PolinRider campaign has expanded from more than 300 affected GitHub owners in March 2026 to over 2,000 owners and 4,000 compromised repositories by July. It infects developers through fake Contagious Interview coding tests, trojanized packages, and repositories or packages poisoned through previously compromised accounts. The malware steals development and cloud credentials, rewrites Git history to conceal injected payloads, and propagates through GitHub and multiple package ecosystems. Recovery requires removing local execution and persistence, cleaning remote repositories, auditing force-push activity, and rotating GitHub, CI/CD, cloud, browser, password-manager, and registry credentials.