DPRK's PolinRider campaign automatically poisoned legitimate npm packages and Go modules after compromising developer machines, rather than deliberately selecting high-value packages for account takeover. OpenSourceMalware linked 20 analyzed packages through reused XOR keys, TRON wallets, blockchain dead drops, a fake font-file loader, and the `temp_auto_push.bat` propagation script. The payload chain delivered DEV#POPPER, InvisibleFerret, and OmniStealer for remote access, credential theft, wallet exfiltration, and keylogging. Investigators also found widespread backdating of malicious Go commits, while Go's permanent proxy cache continued serving affected modules after their GitHub repositories disappeared.