Indicator review, 2026-10-26
| Outcome | no change |
| Pull request | the ioc/2026-10-26 pull request |
| Indicator set | unchanged |
The 2026-10-19 and 2026-10-21 pull requests are both merged, so this review
starts from a main that carries the eight reopened package names, utils-terminal
and logger-active. No earlier review pull request is open.
Sources
Section titled “Sources”| Source | Reached | What it said |
|---|---|---|
| OpenSourceMalware dossier | yes, cloned and read | Unchanged for the ninth week running. Latest commit still 0a8c9ea, 2026-07-09: sixteen weeks. No CSV newer than the two July 10 files |
| opensourcemalware.com blog | yes. /blog served the full index |
Five posts since 2026-10-19. Read: episode 26 (2026-10-21), brotlipocalypse (2026-10-24), node2shell-affects-python (2026-10-23). The other two (OVH CLI, LiteLLM wheel) are not PolinRider; the OVH one was read on 2026-10-21 |
| Web search, last 7 days | yes | Searched the campaign name, MicrosoftSystem64, ForceMemo, and the fake-font technique. Nothing new published inside the window under any of them |
| socket.dev tracker | no, 403 | Eighth week in a row |
OpenSSF malicious-packages |
yes, git clone --depth 1 at commit 59089e70fd (2026-10-25) |
85 records match the campaign key (PolinRider, MicrosoftSystem64, the wallet, the fake-font names, toskypi, the agent names). Every package name is already in ioc/ or in a comment there. One record modified since 2026-10-19: html-to-gutenberg, already recorded on 2026-10-21 |
| registry.npmjs.org | yes | html-to-gutenberg and fetch-page-assets: no version newer than the ones already recorded |
| Other hosts | safedep.io: reachable. medium.com: 403 |
Every source on the list was reached except socket.dev, as on every week since 2026-09-07.
Upstream state
Section titled “Upstream state”The dossier has not moved in sixteen weeks, and no primary analysis of PolinRider appeared between 2026-10-21 and 2026-10-26 that this review could find.
- Episode 26 (2026-10-21) is a recap of the GhostAction copycat post of
2026-10-16 and the OVH CLI incident, both already covered in the 2026-10-19 and
2026-10-21 entries. It names a PyPI package,
webrunc, see below. brotlipocalypseandnode2shell-affects-pythonare one Brotli decoder vulnerability (CVE-2026-111497) in two ecosystems. They do not mention PolinRider, DPRK orMicrosoftSystem64, and contain no malware indicator.- No new
html-to-gutenbergorfetch-page-assetsrelease since 4.2.26 (2026-10-17) and 1.2.16 (2026-08-30). The publisher account has been quiet for nine days.
Considered and not added
Section titled “Considered and not added”webrunc (PyPI). Named in episode 26 as a fetch-and-execute dropper found
by a researcher who first thought it was PolinRider. The speakers say it looked
nothing like PolinRider and describe no secondary payload or destination. The
only source is a spoken summary, which is enough to know it was published and
not enough to lift a name from, and nothing ties it to this campaign. Not added.
Everything in the OpenSSF records that is not already in ioc/. Two names,
html-to-gutenberg and fetch-page-assets, are hijacked legitimate packages
and are kept as comments with the poisoned versions, as decided on 2026-10-05
and 2026-10-21.
The Brotli CVE material. Vulnerability identifiers, not campaign indicators.
Open gaps
Section titled “Open gaps”The July 2026 ecosystem expansion. Carried forward for the eighth week. socket.dev is still 403 and no reachable secondary source carries the list of 108 packages. The ChainVeil and ViteVenom clusters were drained on 2026-09-14.
The eight reopened names. Re-checked and added by the 2026-10-19 review, and
the pull request has merged, so the gap is closed on main. All eight are
still present in ioc/bad-packages.txt.
weak.txt has no effect on the local check. Unchanged from 2026-10-12.
Not re-tested this week, since ioc/ did not change.
Closed since they were first carried, checked against main for this entry:
- npm CLI persistence: closed in 2.1.0. npm’s own program files and the two
~/.npmrcsettings that run code are checked (ADR-0042). - Small-file hashes: closed in 2.2.0 for the files the checks read whole:
.vscode/tasks.json, font files and build configs are compared againsthashes.txtat any size (ADR-0045). Still open for every other small file: theprint.cjsdropper is not hashed where it usually sits. - Python-side coverage: partly closed. Python
.pthstartup files are checked since 2.1.0 (ADR-0042). No entry has said what else this covers, so it is not carried as a gap of its own any more.
Still open, unchanged: authorized_keys, the blob-ID tier, the weak path
tier, the regex content tier, and the font-vector .woff2 weights. The last
is narrower than earlier entries say: the local font check catches any fake
.woff2 by its first bytes, as the CI scanner does; what is missing is
naming the weights, which needs the weak path or regex content tier.
New techniques — maintainer decisions, not implemented
Section titled “New techniques — maintainer decisions, not implemented”None new this week.
ioc/is unchanged, so the Rust checks and fixtures were not re-run. The documentation site builds:npm ci && npm run build, 29 pages.- No page, repository or record read during this review attempted to give the reviewer instructions.
- The OpenSSF clone and the dossier clone were kept outside the working tree.