PolinRider, a developer-repository malware campaign originally attributed to a DPRK threat actor, appeared in repositories also compromised by GhostAction. Investigators found 188 GhostAction commits rewritten to include PolinRider loaders, while GhostAction separately copied PolinRider's hidden VS Code `folderOpen` launcher for a credential stealer deployed across 17,667 repositories. PolinRider used Ethereum transactions to resolve C2 infrastructure and deployed persistent, multi-stage tooling that stole browser sessions, password-vault data, and cryptocurrency-wallet information. The report found no clear relationship between the operators and assessed that they likely shared overlapping victims or stolen repository credentials.