PolinRider operators compromised a legitimate developer's GitHub identity and repeatedly used it to distribute DPRK-attributed NullReceiver malware through `fetch-page-assets` and other npm packages. Although npm removed version 1.2.9, the underlying `.vscode/tasks.json` launcher persisted, and later releases added an obfuscated payload to `babel.config.cjs` that could execute during builds or tests. Coordinated force-pushes affected all seven active repositories owned by the developer, demonstrating account-wide control rather than a one-time package compromise. OpenSourceMalware argues that version-specific advisories and tarball takedowns cannot contain a campaign already confirmed across 4,367 repositories and 2,152 owners.