PolinRider, a DPRK-linked cluster associated with Contagious Interview activity, is testing multiple infection variants across compromised GitHub repositories rather than replacing each build in a linear sequence. An eight-month Binary-Mindz infection involved 853 force-pushes, malicious VS Code tasks, fake `.woff2` font files, executable ESLint and Prisma configurations, and repeated restoration of malware after developer cleanups. The 500 variant uses an Ethereum-based NullReceiver dead drop and reports its build marker to the C2 server, while the more heavily obfuscated 900 variant hides under a legitimate Font Awesome filename. Detection should focus on file contents, automatic folder-open tasks, repository-wide force-push patterns, executable configuration files, and infected contributor machines rather than fixed filenames or commit history alone.