CYFIRMA assesses that Famous Chollima, also known as Lazarus Group, is expanding the PolinRider software supply-chain campaign beyond npm into Go Modules, Packagist, and Chrome extensions. The suspected activity compromises legitimate GitHub repositories and maintainer accounts to reach developer environments and steal credentials, browser data, and cryptocurrency-wallet information. The report characterizes Lazarus as a North Korean state-sponsored actor that combines strategic intelligence collection with financially motivated operations. CYFIRMA provides a low-confidence YARA hunting rule containing five domains and five IPv4 addresses associated with the suspected campaign.