Socket identified PolinRider malware in four development versions of the Packagist package `visanduma/nova-two-factor`, tracing the changes to a compromised GitHub developer account that also accessed private repositories. The North Korea-linked operators rewrite Git history, conceal JavaScript in configuration or font-like files, abuse automatic VS Code tasks, and resolve command-and-control infrastructure through EtherHiding or NullReceiver. A newly observed PHP technique launches obfuscated JavaScript from `index.php` through `shell_exec`. Socket assesses Git-based developer compromise as the campaign's primary propagation model and cryptocurrency theft as its apparent main objective.