{ "intelligence": { "actors": [ { "confidence": 50, "evidence_id": "d8e328f7-eb6a-4e2a-816f-c0a3f0cd35d1", "name": "PolinRider", "role": "acteur lié (relation targets)", "type": "Intrusion-Set" } ], "attack_details": { "coverage": "source-limited", "registry_sha256": "1264bb0843b26bb992f21467bf434089f5315fb216cee8148915fbc868a48636", "schema_version": 1, "source_paragraphs": 49, "sources": [ { "document_sha256": "1067b42eb6a5a04ef500ca768cd16cb0d49b4e485096972558e4365a9121cf7f", "name": "socket.dev", "retrieved_at": "2026-10-19T12:25:21.791284+00:00", "role": "primary", "source_id": "primary", "url": "https://socket.dev/blog/polinrider-github-packagist" } ], "steps": [ { "date": "", "relation": "incident-step", "source_id": "primary", "text": "Des opérateurs de PolinRider ont utilisé un compte GitHub compromis pour infecter quatre versions de développement d’un paquet Packagist." }, { "date": "", "relation": "incident-step", "source_id": "primary", "text": "Des fichiers de configuration modifiés exécutent automatiquement du code pendant la construction du projet." }, { "date": "", "relation": "incident-step", "source_id": "primary", "text": "D’autres échantillons utilisent le paramètre runOn avec la valeur folderOpen dans .vscode/tasks.json pour exécuter du code à l’ouverture du dépôt par un développeur dans un IDE compatible VS Code." }, { "date": "", "relation": "incident-step", "source_id": "primary", "text": "Les envois forcés répétés observés dans le dépôt concordent avec la réécriture de l’historique utilisée par la campagne." }, { "date": "", "relation": "incident-step", "source_id": "primary", "text": "Les données publiques de GitHub ne donnent qu’une vision partielle de l’intrusion." }, { "date": "", "relation": "incident-step", "source_id": "primary", "text": "PolinRider insère du JavaScript lourdement obfusqué directement dans index.php et l’exécute via la fonction PHP shell_exec." }, { "date": "", "relation": "incident-step", "source_id": "primary", "text": "Le comportement permet au code source malveillant déjà planté dans un dépôt d’être disponible via un autre écosystème sans que les opérateurs aient besoin de voler les identifiants ou jetons." }, { "date": "", "relation": "incident-step", "source_id": "primary", "text": "Le code malveillant est présent sur dev-main, mais aucune version stable malveillante n’a été publiée à ce jour." }, { "date": "", "relation": "incident-step", "source_id": "primary", "text": "Les opérateurs semblent disposés à maintenir l’accès." } ] }, "counts": { "actors": 1, "associated_entity_contexts": 0, "deduplicated_iocs": 9, "direct_entities": 21, "direct_relationships": 30, "invalid_iocs": 0, "iocs": 9, "mentioned": 1, "mitre_associated": 0, "mitre_direct": 0, "targets": 1, "techniques": 0, "unsupported_indicators": 0, "vulnerabilities": 0 }, "coverage": { "associated_repertoire_is_incident_evidence": false, "attribution_policy": "explicit-public-relationships-only", "descriptions_publicly_exported": false, "excluded_context_objects": 60, "excluded_graph_objects": 228, "graph_complete": true, "graph_objects": 21, "graph_relationships": 30, "mitre_context_complete": true, "source_url": "https://socket.dev/blog/polinrider-github-packagist", "status_as_of": "2026-10-19T12:24:04+00:00", "table_preview_limit": 20 }, "direct_entities": [ { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:19:52.365Z", "updated_at": "2026-09-26T17:20:01.715Z" }, "description_available": false, "entity_type": "StixFile", "id": "0d145570-6089-4395-a9c3-ea72191fa2cd", "is_inferred": false, "labels": [ "infostealer", "polinrider", "supply chain" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "file--700d1667-ca53-57d7-bbe7-d36143792091", "type": "StixFile" }, { "__typename": "Sector", "aliases": [ "Bitcoin", "Crypto", "Cryptocurrency", "Currency Exchange", "IT", "Information Security", "Software Development", "Technology", "Virtual Currency", "Vulnerability Research", "software" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.394Z", "created_at": "2026-01-18T14:35:11.762Z", "modified": "2026-03-09T09:41:22.635Z", "updated_at": "2026-03-09T09:41:22.635Z" }, "description_available": true, "entity_type": "Sector", "id": "25243a50-06ec-4c1b-8fb2-6a96793e8404", "is_inferred": false, "labels": [], "lang": "en", "name": "Technologies", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "identity--dcacaabc-1244-51fd-8e75-59f4a6fe0aad", "type": "Sector" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:19:36.052Z", "updated_at": "2026-09-26T17:19:40.965Z" }, "description_available": false, "entity_type": "StixFile", "id": "2808a676-ed47-4fa2-b6c6-563828d4514e", "is_inferred": false, "labels": [ "infostealer", "polinrider", "supply chain" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "file--94fdeb32-cc77-564f-bb12-029c26ef3224", "type": "StixFile" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:19:26.913Z", "updated_at": "2026-09-26T17:19:52.058Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "2f9997a3-8e7e-41d7-a0bf-3c3a998ef888", "is_inferred": false, "labels": [ "infostealer", "polinrider", "supply chain" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "ipv4-addr--70ee3d94-ce63-5aee-828b-25d18eb76bc8", "type": "IPv4Addr" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:57:58.508Z", "created_at": "2026-09-26T17:20:43.847Z", "modified": "2026-09-26T17:21:17.453Z", "updated_at": "2026-09-26T17:21:17.453Z" }, "description_available": false, "entity_type": "Indicator", "id": "36a5474b-5773-4528-af42-3d1a7a6dd926", "is_inferred": false, "labels": [ "infostealer", "polinrider", "supply chain" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "indicator--33b0d48d-db11-5e34-a11a-c45ad4f03dd8", "type": "Indicator" }, { "__typename": "IntrusionSet", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:57:58.454Z", "created_at": "2026-09-26T17:19:24.710Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-09-26T17:19:24.940Z", "updated_at": "2026-09-26T17:19:24.940Z" }, "description_available": false, "entity_type": "Intrusion-Set", "id": "442b3a1e-4e6e-473e-b141-a5db7af2daf2", "is_inferred": false, "labels": [], "lang": "en", "name": "PolinRider", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "intrusion-set--f09810d9-f9ee-5fa9-81e5-59cdaf91af08", "type": "IntrusionSet" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:57:58.503Z", "created_at": "2026-09-26T17:20:32.649Z", "modified": "2026-09-26T17:21:12.424Z", "updated_at": "2026-09-26T17:21:12.424Z" }, "description_available": false, "entity_type": "Indicator", "id": "51f8c263-d871-45c5-a7c7-c0d50fddc4fa", "is_inferred": false, "labels": [ "infostealer", "polinrider", "supply chain" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "indicator--0d9050ec-d11c-5bb8-b5cb-8a182bbe5e59", "type": "Indicator" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:19:27.024Z", "updated_at": "2026-09-26T17:20:02.082Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "78c60baa-eb66-4b4c-bfff-15b6c28f71c0", "is_inferred": false, "labels": [ "infostealer", "polinrider", "supply chain" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "ipv4-addr--ade94fd5-2a99-551e-b216-60cf896d72d0", "type": "IPv4Addr" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:57:58.511Z", "created_at": "2026-09-26T17:20:47.764Z", "modified": "2026-09-26T17:21:19.884Z", "updated_at": "2026-09-26T17:21:19.884Z" }, "description_available": false, "entity_type": "Indicator", "id": "78dfa133-3f3b-4f71-95e9-7a783a6c93aa", "is_inferred": false, "labels": [ "infostealer", "polinrider", "supply chain" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "indicator--458877d5-14ed-57e5-8b7a-edd89ff3fcce", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:19:52.143Z", "updated_at": "2026-09-26T17:20:01.712Z" }, "description_available": false, "entity_type": "StixFile", "id": "798ff730-4b88-4cbc-badf-1a8721b0a2e4", "is_inferred": false, "labels": [ "infostealer", "polinrider", "supply chain" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "file--6f03a63e-5cfb-58d0-b6e6-a57cb191703b", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-08T12:35:30.311Z", "created_at": "2026-08-10T23:23:54.315Z", "modified": "2026-09-26T17:20:27.624Z", "updated_at": "2026-09-26T17:20:27.624Z" }, "description_available": false, "entity_type": "Indicator", "id": "850172af-f915-4825-9ed7-0b822d0bd52d", "is_inferred": false, "labels": [ "blockchain loader", "dev#popper", "developer targeting", "infostealer", "npm supply chain", "omnistealer", "polinrider", "remote access trojan", "supply chain" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "indicator--0698ece1-9ac0-5e29-8516-8a8782d058ee", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:19:39.090Z", "updated_at": "2026-09-26T17:19:40.966Z" }, "description_available": false, "entity_type": "StixFile", "id": "88f11859-4bb5-4c71-ad2d-ab944333f482", "is_inferred": false, "labels": [ "infostealer", "polinrider", "supply chain" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "file--3c902050-eac6-5bfb-a57b-cd434cbfec59", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:57:58.495Z", "created_at": "2026-09-26T17:20:11.416Z", "modified": "2026-10-08T18:26:32.564Z", "updated_at": "2026-10-08T18:26:32.564Z" }, "description_available": false, "entity_type": "Indicator", "id": "9ac669e0-d80b-4564-a44e-fb437d55cb72", "is_inferred": false, "labels": [ "infostealer", "polinrider", "supply chain" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "indicator--6153000d-3d06-56b5-a5ea-6c9c0dd4d2a4", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:19:52.146Z", "updated_at": "2026-09-26T17:20:01.714Z" }, "description_available": false, "entity_type": "StixFile", "id": "9bd8332d-70c1-47cc-948d-7a2e47a07517", "is_inferred": false, "labels": [ "infostealer", "polinrider", "supply chain" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "file--9b24a0a4-0e72-51bc-8ff3-f110ba1912e6", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:57:58.493Z", "created_at": "2026-09-26T17:20:11.420Z", "modified": "2026-10-08T18:26:32.564Z", "updated_at": "2026-10-08T18:26:32.564Z" }, "description_available": false, "entity_type": "Indicator", "id": "9de23827-6343-48c5-8f98-4cd45862c0be", "is_inferred": false, "labels": [ "infostealer", "polinrider", "supply chain" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "indicator--e29cebea-d006-5512-b2a6-96648c66fc18", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:57:58.498Z", "created_at": "2026-09-26T17:20:30.390Z", "modified": "2026-10-08T18:26:32.567Z", "updated_at": "2026-10-08T18:26:32.567Z" }, "description_available": false, "entity_type": "Indicator", "id": "ab4b05db-a422-4be4-b1fd-503eb8432f14", "is_inferred": false, "labels": [ "infostealer", "polinrider", "supply chain" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "indicator--e3e76c97-d934-5c08-b83c-e11eba97cc59", "type": "Indicator" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:19:35.347Z", "updated_at": "2026-09-26T17:20:13.630Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "cf30da02-a96c-40e6-a055-e0101329e2ef", "is_inferred": false, "labels": [ "infostealer", "polinrider", "supply chain" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "ipv4-addr--769eb004-6dfe-5945-a1e3-aadae33da21a", "type": "IPv4Addr" }, { "__typename": "Malware", "aliases": [], "attributes": { "is_family": false }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:57:58.455Z", "created_at": "2026-09-26T17:19:24.756Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-09-26T17:19:25.219Z", "updated_at": "2026-09-26T17:19:25.219Z" }, "description_available": false, "entity_type": "Malware", "id": "dafcf71d-2696-404a-8c1c-ce9362e130a4", "is_inferred": false, "labels": [], "lang": "en", "name": "PolinRider", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "malware--f09810d9-f9ee-5fa9-81e5-59cdaf91af08", "type": "Malware" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:57:58.500Z", "created_at": "2026-09-26T17:20:30.501Z", "modified": "2026-09-26T17:21:05.587Z", "updated_at": "2026-09-26T17:21:05.587Z" }, "description_available": false, "entity_type": "Indicator", "id": "dc6c5401-4f1d-4d0a-8f44-ff01fd8bccbe", "is_inferred": false, "labels": [ "infostealer", "polinrider", "supply chain" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "indicator--30fb0fed-e92d-5483-8fcb-c7ae24d51708", "type": "Indicator" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-08-10T23:23:39.770Z", "updated_at": "2026-09-26T17:19:32.650Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "e539a8ca-a272-40a0-8ec1-ea2e11b8b127", "is_inferred": false, "labels": [ "blockchain loader", "dev#popper", "developer targeting", "infostealer", "npm supply chain", "omnistealer", "polinrider", "remote access trojan", "supply chain" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "ipv4-addr--d4994aa1-519a-59ad-9526-452dff31231f", "type": "IPv4Addr" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:57:58.505Z", "created_at": "2026-09-26T17:20:43.756Z", "modified": "2026-09-26T17:21:15.659Z", "updated_at": "2026-09-26T17:21:15.659Z" }, "description_available": false, "entity_type": "Indicator", "id": "f7256389-6f9e-4762-8b15-988d1e2f35a9", "is_inferred": false, "labels": [ "infostealer", "polinrider", "supply chain" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "indicator--ca7a8069-9310-568d-a5c1-c66113dac9ac", "type": "Indicator" } ], "direct_relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:57:58.510Z", "created_at": "2026-09-26T17:21:59.258Z", "modified": "2026-09-26T17:22:00.686Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:22:00.686Z" }, "description_available": false, "entity_type": "based-on", "fromId": "36a5474b-5773-4528-af42-3d1a7a6dd926", "from_id": "36a5474b-5773-4528-af42-3d1a7a6dd926", "from_name": null, "from_type": "Indicator", "id": "0297a734-61b5-4c0a-8c6c-0d6dc4c511ab", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "relationship--480cc07c-2c6c-5339-8d00-8b74f3641ac3", "toId": "9bd8332d-70c1-47cc-948d-7a2e47a07517", "to_id": "9bd8332d-70c1-47cc-948d-7a2e47a07517", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:57:58.604Z", "created_at": "2026-09-26T17:24:01.473Z", "modified": "2026-09-26T17:24:01.848Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:24:01.848Z" }, "description_available": false, "entity_type": "indicates", "fromId": "78dfa133-3f3b-4f71-95e9-7a783a6c93aa", "from_id": "78dfa133-3f3b-4f71-95e9-7a783a6c93aa", "from_name": null, "from_type": "Indicator", "id": "06a63bb1-a45f-449b-8d26-128e0160a1f4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "relationship--c9217752-0778-5dbf-bc7a-b9781812946e", "toId": "dafcf71d-2696-404a-8c1c-ce9362e130a4", "to_id": "dafcf71d-2696-404a-8c1c-ce9362e130a4", "to_name": "PolinRider", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:57:58.559Z", "created_at": "2026-09-26T17:22:59.217Z", "modified": "2026-09-26T17:22:59.396Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:22:59.396Z" }, "description_available": false, "entity_type": "indicates", "fromId": "dc6c5401-4f1d-4d0a-8f44-ff01fd8bccbe", "from_id": "dc6c5401-4f1d-4d0a-8f44-ff01fd8bccbe", "from_name": null, "from_type": "Indicator", "id": "08bc9a3d-a672-4c2d-9d8a-96ac1f9d89b5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "relationship--fe605ef3-1e05-52a4-bd8a-0ebec64c0853", "toId": "442b3a1e-4e6e-473e-b141-a5db7af2daf2", "to_id": "442b3a1e-4e6e-473e-b141-a5db7af2daf2", "to_name": "PolinRider", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:57:58.504Z", "created_at": "2026-09-26T17:21:58.174Z", "modified": "2026-09-26T17:21:58.735Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:21:58.735Z" }, "description_available": false, "entity_type": "based-on", "fromId": "51f8c263-d871-45c5-a7c7-c0d50fddc4fa", "from_id": "51f8c263-d871-45c5-a7c7-c0d50fddc4fa", "from_name": null, "from_type": "Indicator", "id": "0c6bafd3-e65f-4e58-9145-4dc0e22a50be", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "relationship--a6747508-ab2f-53d3-9ca1-d7945a406480", "toId": "88f11859-4bb5-4c71-ad2d-ab944333f482", "to_id": "88f11859-4bb5-4c71-ad2d-ab944333f482", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:57:58.513Z", "created_at": "2026-09-26T17:22:01.154Z", "modified": "2026-09-26T17:22:01.733Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:22:01.733Z" }, "description_available": false, "entity_type": "indicates", "fromId": "850172af-f915-4825-9ed7-0b822d0bd52d", "from_id": "850172af-f915-4825-9ed7-0b822d0bd52d", "from_name": null, "from_type": "Indicator", "id": "1930edef-1ae0-4f8b-aa90-f22c8f1ff1ee", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "relationship--5ddc5ceb-2b0b-565a-90af-e7fa84ebed6a", "toId": "442b3a1e-4e6e-473e-b141-a5db7af2daf2", "to_id": "442b3a1e-4e6e-473e-b141-a5db7af2daf2", "to_name": "PolinRider", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:57:58.494Z", "created_at": "2026-09-26T17:21:56.492Z", "modified": "2026-09-26T17:21:56.742Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:21:56.742Z" }, "description_available": false, "entity_type": "based-on", "fromId": "9de23827-6343-48c5-8f98-4cd45862c0be", "from_id": "9de23827-6343-48c5-8f98-4cd45862c0be", "from_name": null, "from_type": "Indicator", "id": "215847fc-bde7-43fb-8e15-7f381c99547c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "relationship--d7084385-8c12-5d3b-84c7-b9986d3ab8a5", "toId": "2f9997a3-8e7e-41d7-a0bf-3c3a998ef888", "to_id": "2f9997a3-8e7e-41d7-a0bf-3c3a998ef888", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:57:58.513Z", "created_at": "2026-09-26T17:22:04.020Z", "modified": "2026-09-26T17:22:04.287Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:22:04.287Z" }, "description_available": false, "entity_type": "indicates", "fromId": "850172af-f915-4825-9ed7-0b822d0bd52d", "from_id": "850172af-f915-4825-9ed7-0b822d0bd52d", "from_name": null, "from_type": "Indicator", "id": "275b9489-d37c-4fc9-a1d4-a745a49aadaa", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "relationship--7951432d-0f06-5da8-8573-645ef434542b", "toId": "dafcf71d-2696-404a-8c1c-ce9362e130a4", "to_id": "dafcf71d-2696-404a-8c1c-ce9362e130a4", "to_name": "PolinRider", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:57:58.501Z", "created_at": "2026-09-26T17:21:58.080Z", "modified": "2026-09-26T17:21:58.451Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:21:58.451Z" }, "description_available": false, "entity_type": "based-on", "fromId": "dc6c5401-4f1d-4d0a-8f44-ff01fd8bccbe", "from_id": "dc6c5401-4f1d-4d0a-8f44-ff01fd8bccbe", "from_name": null, "from_type": "Indicator", "id": "3d1acd99-3610-46f4-aca9-3038ec966fba", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "relationship--0e11998d-78c0-5f93-9ef2-70e8be7ddf0e", "toId": "2808a676-ed47-4fa2-b6c6-563828d4514e", "to_id": "2808a676-ed47-4fa2-b6c6-563828d4514e", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:57:58.512Z", "created_at": "2026-09-26T17:21:59.264Z", "modified": "2026-09-26T17:22:00.687Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:22:00.687Z" }, "description_available": false, "entity_type": "based-on", "fromId": "78dfa133-3f3b-4f71-95e9-7a783a6c93aa", "from_id": "78dfa133-3f3b-4f71-95e9-7a783a6c93aa", "from_name": null, "from_type": "Indicator", "id": "3d85b5c7-e2fd-4f8c-b76f-16a04fc50274", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "relationship--97232cb5-544e-5919-815f-a78a5c67881e", "toId": "0d145570-6089-4395-a9c3-ea72191fa2cd", "to_id": "0d145570-6089-4395-a9c3-ea72191fa2cd", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:57:58.581Z", "created_at": "2026-09-26T17:23:28.310Z", "modified": "2026-09-26T17:23:28.536Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:23:28.536Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f7256389-6f9e-4762-8b15-988d1e2f35a9", "from_id": "f7256389-6f9e-4762-8b15-988d1e2f35a9", "from_name": null, "from_type": "Indicator", "id": "4b7a1efb-ee21-4e80-b347-0f4a9372133b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "relationship--6c513bb4-b700-52c9-887d-fe0b8dcc7757", "toId": "442b3a1e-4e6e-473e-b141-a5db7af2daf2", "to_id": "442b3a1e-4e6e-473e-b141-a5db7af2daf2", "to_name": "PolinRider", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:57:58.546Z", "created_at": "2026-09-26T17:22:49.240Z", "modified": "2026-09-26T17:22:49.852Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:22:49.852Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ab4b05db-a422-4be4-b1fd-503eb8432f14", "from_id": "ab4b05db-a422-4be4-b1fd-503eb8432f14", "from_name": null, "from_type": "Indicator", "id": "57b368d7-e762-4835-bf0b-81705e6128dc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "relationship--a03d9f4a-3398-5777-bc1e-41a6052bf56b", "toId": "dafcf71d-2696-404a-8c1c-ce9362e130a4", "to_id": "dafcf71d-2696-404a-8c1c-ce9362e130a4", "to_name": "PolinRider", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:57:58.582Z", "created_at": "2026-09-26T17:23:28.942Z", "modified": "2026-09-26T17:23:29.276Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:23:29.276Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f7256389-6f9e-4762-8b15-988d1e2f35a9", "from_id": "f7256389-6f9e-4762-8b15-988d1e2f35a9", "from_name": null, "from_type": "Indicator", "id": "5f23d618-c5a8-4b3e-9b2e-47688f139bb3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "relationship--325b2b12-6be0-5b23-b992-1a0c3ff566d7", "toId": "dafcf71d-2696-404a-8c1c-ce9362e130a4", "to_id": "dafcf71d-2696-404a-8c1c-ce9362e130a4", "to_name": "PolinRider", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:57:58.593Z", "created_at": "2026-09-26T17:23:44.642Z", "modified": "2026-09-26T17:23:45.038Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:23:45.038Z" }, "description_available": false, "entity_type": "indicates", "fromId": "36a5474b-5773-4528-af42-3d1a7a6dd926", "from_id": "36a5474b-5773-4528-af42-3d1a7a6dd926", "from_name": null, "from_type": "Indicator", "id": "5fbac2e8-7aa9-4ec0-a337-3655cd41b80f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "relationship--9ea543c8-e097-5f13-8792-c8ad3cff4f19", "toId": "dafcf71d-2696-404a-8c1c-ce9362e130a4", "to_id": "dafcf71d-2696-404a-8c1c-ce9362e130a4", "to_name": "PolinRider", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:57:58.570Z", "created_at": "2026-09-26T17:23:17.414Z", "modified": "2026-09-26T17:23:17.682Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:23:17.682Z" }, "description_available": false, "entity_type": "indicates", "fromId": "51f8c263-d871-45c5-a7c7-c0d50fddc4fa", "from_id": "51f8c263-d871-45c5-a7c7-c0d50fddc4fa", "from_name": null, "from_type": "Indicator", "id": "62f9f8af-350c-4088-b1d2-79ae26cbe598", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "relationship--1028a51f-2f0c-5397-8348-0fa8d2b26311", "toId": "442b3a1e-4e6e-473e-b141-a5db7af2daf2", "to_id": "442b3a1e-4e6e-473e-b141-a5db7af2daf2", "to_name": "PolinRider", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:57:58.535Z", "created_at": "2026-09-26T17:22:35.143Z", "modified": "2026-09-26T17:22:35.316Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:22:35.316Z" }, "description_available": false, "entity_type": "indicates", "fromId": "9ac669e0-d80b-4564-a44e-fb437d55cb72", "from_id": "9ac669e0-d80b-4564-a44e-fb437d55cb72", "from_name": null, "from_type": "Indicator", "id": "6b3b5382-4593-405d-838a-f5f02b9e3bcc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "relationship--2116c0bf-64e5-566d-8dbc-5a42b985b47c", "toId": "442b3a1e-4e6e-473e-b141-a5db7af2daf2", "to_id": "442b3a1e-4e6e-473e-b141-a5db7af2daf2", "to_name": "PolinRider", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:57:58.524Z", "created_at": "2026-09-26T17:22:15.686Z", "modified": "2026-09-26T17:22:15.915Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:22:15.915Z" }, "description_available": false, "entity_type": "indicates", "fromId": "9de23827-6343-48c5-8f98-4cd45862c0be", "from_id": "9de23827-6343-48c5-8f98-4cd45862c0be", "from_name": null, "from_type": "Indicator", "id": "8637e0a8-c855-4c41-b18b-0e47e7e63f0a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "relationship--84e5d96d-e0e1-51bf-9901-c78ab1dee137", "toId": "442b3a1e-4e6e-473e-b141-a5db7af2daf2", "to_id": "442b3a1e-4e6e-473e-b141-a5db7af2daf2", "to_name": "PolinRider", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:57:58.570Z", "created_at": "2026-09-26T17:23:18.196Z", "modified": "2026-09-26T17:23:18.348Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:23:18.348Z" }, "description_available": false, "entity_type": "indicates", "fromId": "51f8c263-d871-45c5-a7c7-c0d50fddc4fa", "from_id": "51f8c263-d871-45c5-a7c7-c0d50fddc4fa", "from_name": null, "from_type": "Indicator", "id": "9180c69d-5ecd-413d-b2c4-485207420c5f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "relationship--442bb040-0065-5d3d-9770-a07958e7dfd7", "toId": "dafcf71d-2696-404a-8c1c-ce9362e130a4", "to_id": "dafcf71d-2696-404a-8c1c-ce9362e130a4", "to_name": "PolinRider", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:57:58.525Z", "created_at": "2026-09-26T17:22:19.793Z", "modified": "2026-09-26T17:22:20.071Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:22:20.071Z" }, "description_available": false, "entity_type": "indicates", "fromId": "9de23827-6343-48c5-8f98-4cd45862c0be", "from_id": "9de23827-6343-48c5-8f98-4cd45862c0be", "from_name": null, "from_type": "Indicator", "id": "93e926dc-484f-4eb3-9ae3-4490faeaaf9a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "relationship--409a6573-fe7f-58b3-bf3c-c4091aa06ecb", "toId": "dafcf71d-2696-404a-8c1c-ce9362e130a4", "to_id": "dafcf71d-2696-404a-8c1c-ce9362e130a4", "to_name": "PolinRider", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:57:58.593Z", "created_at": "2026-09-26T17:23:44.293Z", "modified": "2026-09-26T17:23:44.437Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:23:44.437Z" }, "description_available": false, "entity_type": "indicates", "fromId": "36a5474b-5773-4528-af42-3d1a7a6dd926", "from_id": "36a5474b-5773-4528-af42-3d1a7a6dd926", "from_name": null, "from_type": "Indicator", "id": "9e7a6432-641e-488a-9c02-e615051de3b7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "relationship--413ef545-42e8-5a0c-80e1-da0139d3710b", "toId": "442b3a1e-4e6e-473e-b141-a5db7af2daf2", "to_id": "442b3a1e-4e6e-473e-b141-a5db7af2daf2", "to_name": "PolinRider", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:57:58.499Z", "created_at": "2026-09-26T17:21:57.249Z", "modified": "2026-09-26T17:21:57.567Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:21:57.567Z" }, "description_available": false, "entity_type": "based-on", "fromId": "ab4b05db-a422-4be4-b1fd-503eb8432f14", "from_id": "ab4b05db-a422-4be4-b1fd-503eb8432f14", "from_name": null, "from_type": "Indicator", "id": "a4739e31-fa91-491b-9e19-1d2f6e5e25da", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "relationship--6327edbd-d161-5a66-8bda-8738c42095a2", "toId": "cf30da02-a96c-40e6-a055-e0101329e2ef", "to_id": "cf30da02-a96c-40e6-a055-e0101329e2ef", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:57:58.456Z", "created_at": "2026-09-26T17:21:17.771Z", "modified": "2026-09-26T17:21:18.044Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:21:18.044Z" }, "description_available": false, "entity_type": "uses", "fromId": "442b3a1e-4e6e-473e-b141-a5db7af2daf2", "from_id": "442b3a1e-4e6e-473e-b141-a5db7af2daf2", "from_name": "PolinRider", "from_type": "IntrusionSet", "id": "a81b4495-620d-4334-9ed2-dd44233793c2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "relationship--0b738138-1361-5bb1-8c38-c305874c8b08", "toId": "dafcf71d-2696-404a-8c1c-ce9362e130a4", "to_id": "dafcf71d-2696-404a-8c1c-ce9362e130a4", "to_name": "PolinRider", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:57:58.507Z", "created_at": "2026-09-26T17:21:59.014Z", "modified": "2026-09-26T17:22:00.403Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:22:00.403Z" }, "description_available": false, "entity_type": "based-on", "fromId": "f7256389-6f9e-4762-8b15-988d1e2f35a9", "from_id": "f7256389-6f9e-4762-8b15-988d1e2f35a9", "from_name": null, "from_type": "Indicator", "id": "a84aa0a1-8c02-45a3-bb4a-17bb0d075903", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "relationship--1e39094c-464f-5da0-bd92-de090c2041e0", "toId": "798ff730-4b88-4cbc-badf-1a8721b0a2e4", "to_id": "798ff730-4b88-4cbc-badf-1a8721b0a2e4", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:57:58.536Z", "created_at": "2026-09-26T17:22:35.639Z", "modified": "2026-09-26T17:22:36.009Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:22:36.009Z" }, "description_available": false, "entity_type": "indicates", "fromId": "9ac669e0-d80b-4564-a44e-fb437d55cb72", "from_id": "9ac669e0-d80b-4564-a44e-fb437d55cb72", "from_name": null, "from_type": "Indicator", "id": "aa5d3846-c09e-4aa0-8f55-271ea5266fb4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "relationship--74e84b17-92f2-59d8-a2ce-e7b8ee6fb525", "toId": "dafcf71d-2696-404a-8c1c-ce9362e130a4", "to_id": "dafcf71d-2696-404a-8c1c-ce9362e130a4", "to_name": "PolinRider", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:57:58.497Z", "created_at": "2026-09-26T17:21:57.045Z", "modified": "2026-09-26T17:21:57.297Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:21:57.297Z" }, "description_available": false, "entity_type": "based-on", "fromId": "9ac669e0-d80b-4564-a44e-fb437d55cb72", "from_id": "9ac669e0-d80b-4564-a44e-fb437d55cb72", "from_name": null, "from_type": "Indicator", "id": "aae431a3-bd0f-4348-8b3a-fb5fb89cc067", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "relationship--b4e6f91c-dbe8-5f0b-bfc1-738419665748", "toId": "78c60baa-eb66-4b4c-bfff-15b6c28f71c0", "to_id": "78c60baa-eb66-4b4c-bfff-15b6c28f71c0", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:57:58.489Z", "created_at": "2026-09-26T17:21:08.166Z", "modified": "2026-09-26T17:21:09.252Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:21:09.252Z" }, "description_available": false, "entity_type": "targets", "fromId": "dafcf71d-2696-404a-8c1c-ce9362e130a4", "from_id": "dafcf71d-2696-404a-8c1c-ce9362e130a4", "from_name": "PolinRider", "from_type": "Malware", "id": "b7e390ab-086f-4312-8b99-39c471f28cef", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "relationship--149de19e-75c6-5a4d-8703-bf255efd93d8", "toId": "25243a50-06ec-4c1b-8fb2-6a96793e8404", "to_id": "25243a50-06ec-4c1b-8fb2-6a96793e8404", "to_name": "Technologies", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:57:58.559Z", "created_at": "2026-09-26T17:22:59.925Z", "modified": "2026-09-26T17:23:00.966Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:23:00.966Z" }, "description_available": false, "entity_type": "indicates", "fromId": "dc6c5401-4f1d-4d0a-8f44-ff01fd8bccbe", "from_id": "dc6c5401-4f1d-4d0a-8f44-ff01fd8bccbe", "from_name": null, "from_type": "Indicator", "id": "b8bd6302-1615-4038-89e0-e3824f608d21", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "relationship--83688b08-7541-5212-a8c7-ae8e6648ab24", "toId": "dafcf71d-2696-404a-8c1c-ce9362e130a4", "to_id": "dafcf71d-2696-404a-8c1c-ce9362e130a4", "to_name": "PolinRider", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:57:58.489Z", "created_at": "2026-09-26T17:21:01.754Z", "modified": "2026-09-26T17:21:05.492Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:21:05.492Z" }, "description_available": false, "entity_type": "targets", "fromId": "442b3a1e-4e6e-473e-b141-a5db7af2daf2", "from_id": "442b3a1e-4e6e-473e-b141-a5db7af2daf2", "from_name": "PolinRider", "from_type": "IntrusionSet", "id": "d8e328f7-eb6a-4e2a-816f-c0a3f0cd35d1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "relationship--71e3833a-d7b5-5ced-8204-f07a622790a5", "toId": "25243a50-06ec-4c1b-8fb2-6a96793e8404", "to_id": "25243a50-06ec-4c1b-8fb2-6a96793e8404", "to_name": "Technologies", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:57:58.546Z", "created_at": "2026-09-26T17:22:48.184Z", "modified": "2026-09-26T17:22:48.360Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:22:48.360Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ab4b05db-a422-4be4-b1fd-503eb8432f14", "from_id": "ab4b05db-a422-4be4-b1fd-503eb8432f14", "from_name": null, "from_type": "Indicator", "id": "dff12f09-3079-4334-9203-7ac54eb1b489", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "relationship--a496cac2-98f5-508b-b9ef-57bec94aad3c", "toId": "442b3a1e-4e6e-473e-b141-a5db7af2daf2", "to_id": "442b3a1e-4e6e-473e-b141-a5db7af2daf2", "to_name": "PolinRider", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:57:58.604Z", "created_at": "2026-09-26T17:23:55.572Z", "modified": "2026-09-26T17:23:56.098Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:23:56.098Z" }, "description_available": false, "entity_type": "indicates", "fromId": "78dfa133-3f3b-4f71-95e9-7a783a6c93aa", "from_id": "78dfa133-3f3b-4f71-95e9-7a783a6c93aa", "from_name": null, "from_type": "Indicator", "id": "f51bf953-bf7c-481e-ad25-cc81c39eb9cf", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "relationship--b2bddf59-45a8-56af-a493-af97b2d44993", "toId": "442b3a1e-4e6e-473e-b141-a5db7af2daf2", "to_id": "442b3a1e-4e6e-473e-b141-a5db7af2daf2", "to_name": "PolinRider", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-08T12:35:30.313Z", "created_at": "2026-08-10T23:24:45.633Z", "modified": "2026-08-10T23:24:45.851Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-08-10T23:24:45.851Z" }, "description_available": false, "entity_type": "based-on", "fromId": "850172af-f915-4825-9ed7-0b822d0bd52d", "from_id": "850172af-f915-4825-9ed7-0b822d0bd52d", "from_name": null, "from_type": "Indicator", "id": "f8f25303-5d71-4a6f-b45d-ecd00cb131af", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socket.dev/blog/polinrider-github-packagist", "standard_id": "relationship--cd2c48c3-5d34-5248-94b7-0a3db7dc0dd2", "toId": "e539a8ca-a272-40a0-8ec1-ea2e11b8b127", "to_id": "e539a8ca-a272-40a0-8ec1-ea2e11b8b127", "to_name": null, "to_type": "IPv4Addr" } ], "iocs": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "166[.]88[.]134[.]62", "description_available": false, "object_id": "850172af-f915-4825-9ed7-0b822d0bd52d", "object_ids": [ "850172af-f915-4825-9ed7-0b822d0bd52d", "e539a8ca-a272-40a0-8ec1-ea2e11b8b127" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "850172af-f915-4825-9ed7-0b822d0bd52d", "valid_from": "2026-07-29T02:59:34.000Z", "valid_until": "2026-08-18T08:34:13.434Z", "validity_status": "revoked", "value": "166.88.134.62" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "e539a8ca-a272-40a0-8ec1-ea2e11b8b127", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "166.88.134.62" } ], "source_url": "https://socket.dev/blog/polinrider-github-packagist", "type": "ipv4", "valid_from": "2026-07-29T02:59:34.000Z", "valid_until": "2026-08-18T08:34:13.434Z", "validity_status": "revoked", "value": "166.88.134.62" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "166[.]88[.]73[.]46", "description_available": false, "object_id": "9ac669e0-d80b-4564-a44e-fb437d55cb72", "object_ids": [ "78c60baa-eb66-4b4c-bfff-15b6c28f71c0", "9ac669e0-d80b-4564-a44e-fb437d55cb72" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "9ac669e0-d80b-4564-a44e-fb437d55cb72", "valid_from": "2026-09-18T12:51:26.000Z", "valid_until": "2026-10-08T18:26:05.434Z", "validity_status": "revoked", "value": "166.88.73.46" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "78c60baa-eb66-4b4c-bfff-15b6c28f71c0", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "166.88.73.46" } ], "source_url": "https://socket.dev/blog/polinrider-github-packagist", "type": "ipv4", "valid_from": "2026-09-18T12:51:26.000Z", "valid_until": "2026-10-08T18:26:05.434Z", "validity_status": "revoked", "value": "166.88.73.46" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "193[.]247[.]144[.]38", "description_available": false, "object_id": "ab4b05db-a422-4be4-b1fd-503eb8432f14", "object_ids": [ "ab4b05db-a422-4be4-b1fd-503eb8432f14", "cf30da02-a96c-40e6-a055-e0101329e2ef" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "ab4b05db-a422-4be4-b1fd-503eb8432f14", "valid_from": "2026-09-18T12:51:26.000Z", "valid_until": "2026-10-08T18:26:05.434Z", "validity_status": "revoked", "value": "193.247.144.38" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "cf30da02-a96c-40e6-a055-e0101329e2ef", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "193.247.144.38" } ], "source_url": "https://socket.dev/blog/polinrider-github-packagist", "type": "ipv4", "valid_from": "2026-09-18T12:51:26.000Z", "valid_until": "2026-10-08T18:26:05.434Z", "validity_status": "revoked", "value": "193.247.144.38" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "23[.]27[.]13[.]135", "description_available": false, "object_id": "9de23827-6343-48c5-8f98-4cd45862c0be", "object_ids": [ "2f9997a3-8e7e-41d7-a0bf-3c3a998ef888", "9de23827-6343-48c5-8f98-4cd45862c0be" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "9de23827-6343-48c5-8f98-4cd45862c0be", "valid_from": "2026-09-18T12:51:26.000Z", "valid_until": "2026-10-08T18:26:05.434Z", "validity_status": "revoked", "value": "23.27.13.135" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "2f9997a3-8e7e-41d7-a0bf-3c3a998ef888", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "23.27.13.135" } ], "source_url": "https://socket.dev/blog/polinrider-github-packagist", "type": "ipv4", "valid_from": "2026-09-18T12:51:26.000Z", "valid_until": "2026-10-08T18:26:05.434Z", "validity_status": "revoked", "value": "23.27.13.135" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "139ea03dcddf4aa810d55740be3cf6c92ce7a9f3cbcbbb35440e25b769a87683", "description_available": false, "object_id": "36a5474b-5773-4528-af42-3d1a7a6dd926", "object_ids": [ "36a5474b-5773-4528-af42-3d1a7a6dd926", "9bd8332d-70c1-47cc-948d-7a2e47a07517" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "36a5474b-5773-4528-af42-3d1a7a6dd926", "valid_from": "2026-09-18T12:51:26.000Z", "valid_until": "2027-07-06T00:01:10.557Z", "validity_status": "active", "value": "139ea03dcddf4aa810d55740be3cf6c92ce7a9f3cbcbbb35440e25b769a87683" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "9bd8332d-70c1-47cc-948d-7a2e47a07517", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "139ea03dcddf4aa810d55740be3cf6c92ce7a9f3cbcbbb35440e25b769a87683" } ], "source_url": "https://socket.dev/blog/polinrider-github-packagist", "type": "sha256", "valid_from": "2026-09-18T12:51:26.000Z", "valid_until": "2027-07-06T00:01:10.557Z", "validity_status": "active", "value": "139ea03dcddf4aa810d55740be3cf6c92ce7a9f3cbcbbb35440e25b769a87683" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "515a53291d25d229e1f9fa72e66407e1cfd7e77c91478400b24d5185af68531a", "description_available": false, "object_id": "78dfa133-3f3b-4f71-95e9-7a783a6c93aa", "object_ids": [ "0d145570-6089-4395-a9c3-ea72191fa2cd", "78dfa133-3f3b-4f71-95e9-7a783a6c93aa" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "78dfa133-3f3b-4f71-95e9-7a783a6c93aa", "valid_from": "2026-09-18T12:51:26.000Z", "valid_until": "2027-07-06T00:01:10.557Z", "validity_status": "active", "value": "515a53291d25d229e1f9fa72e66407e1cfd7e77c91478400b24d5185af68531a" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "0d145570-6089-4395-a9c3-ea72191fa2cd", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "515a53291d25d229e1f9fa72e66407e1cfd7e77c91478400b24d5185af68531a" } ], "source_url": "https://socket.dev/blog/polinrider-github-packagist", "type": "sha256", "valid_from": "2026-09-18T12:51:26.000Z", "valid_until": "2027-07-06T00:01:10.557Z", "validity_status": "active", "value": "515a53291d25d229e1f9fa72e66407e1cfd7e77c91478400b24d5185af68531a" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "7d47c430e6e404dc2fa8b4837678d1cbdb4d0aeacec9b405655cab79d54a2ad9", "description_available": false, "object_id": "dc6c5401-4f1d-4d0a-8f44-ff01fd8bccbe", "object_ids": [ "2808a676-ed47-4fa2-b6c6-563828d4514e", "dc6c5401-4f1d-4d0a-8f44-ff01fd8bccbe" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "dc6c5401-4f1d-4d0a-8f44-ff01fd8bccbe", "valid_from": "2026-09-18T12:51:26.000Z", "valid_until": "2027-07-06T00:01:10.557Z", "validity_status": "active", "value": "7d47c430e6e404dc2fa8b4837678d1cbdb4d0aeacec9b405655cab79d54a2ad9" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "2808a676-ed47-4fa2-b6c6-563828d4514e", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "7d47c430e6e404dc2fa8b4837678d1cbdb4d0aeacec9b405655cab79d54a2ad9" } ], "source_url": "https://socket.dev/blog/polinrider-github-packagist", "type": "sha256", "valid_from": "2026-09-18T12:51:26.000Z", "valid_until": "2027-07-06T00:01:10.557Z", "validity_status": "active", "value": "7d47c430e6e404dc2fa8b4837678d1cbdb4d0aeacec9b405655cab79d54a2ad9" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "b7ede935d4979146b55f12b9eec7c83b61962b478f5dc9b8db251e539ec2abd3", "description_available": false, "object_id": "51f8c263-d871-45c5-a7c7-c0d50fddc4fa", "object_ids": [ "51f8c263-d871-45c5-a7c7-c0d50fddc4fa", "88f11859-4bb5-4c71-ad2d-ab944333f482" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "51f8c263-d871-45c5-a7c7-c0d50fddc4fa", "valid_from": "2026-09-18T12:51:26.000Z", "valid_until": "2027-07-06T00:01:10.557Z", "validity_status": "active", "value": "b7ede935d4979146b55f12b9eec7c83b61962b478f5dc9b8db251e539ec2abd3" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "88f11859-4bb5-4c71-ad2d-ab944333f482", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "b7ede935d4979146b55f12b9eec7c83b61962b478f5dc9b8db251e539ec2abd3" } ], "source_url": "https://socket.dev/blog/polinrider-github-packagist", "type": "sha256", "valid_from": "2026-09-18T12:51:26.000Z", "valid_until": "2027-07-06T00:01:10.557Z", "validity_status": "active", "value": "b7ede935d4979146b55f12b9eec7c83b61962b478f5dc9b8db251e539ec2abd3" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "ccb187dc9de0cc7477c9817ae53365d273e121407c0305f863e2ab67c35d6395", "description_available": false, "object_id": "f7256389-6f9e-4762-8b15-988d1e2f35a9", "object_ids": [ "798ff730-4b88-4cbc-badf-1a8721b0a2e4", "f7256389-6f9e-4762-8b15-988d1e2f35a9" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "f7256389-6f9e-4762-8b15-988d1e2f35a9", "valid_from": "2026-09-18T12:51:26.000Z", "valid_until": "2027-07-06T00:01:10.557Z", "validity_status": "active", "value": "ccb187dc9de0cc7477c9817ae53365d273e121407c0305f863e2ab67c35d6395" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "798ff730-4b88-4cbc-badf-1a8721b0a2e4", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "ccb187dc9de0cc7477c9817ae53365d273e121407c0305f863e2ab67c35d6395" } ], "source_url": "https://socket.dev/blog/polinrider-github-packagist", "type": "sha256", "valid_from": "2026-09-18T12:51:26.000Z", "valid_until": "2027-07-06T00:01:10.557Z", "validity_status": "active", "value": "ccb187dc9de0cc7477c9817ae53365d273e121407c0305f863e2ab67c35d6395" } ], "mentioned": [ { "confidence": 50, "evidence_id": "dafcf71d-2696-404a-8c1c-ce9362e130a4", "name": "PolinRider", "role": "mentionné", "type": "Malware" } ], "mitre": { "associated_repertoire": [], "direct_techniques": [] }, "report_metadata": { "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-18T12:51:25.360Z", "created_at": "2026-09-26T17:24:11.855Z", "modified": "2026-09-26T17:24:13.759Z", "published": "2026-09-18T12:51:25.360Z", "updated_at": "2026-09-26T17:24:13.759Z" }, "description_available": true, "id": "53ad0f19-db8a-4be4-8cad-4798fff331dc", "is_inferred": false, "labels": [ "infostealer", "polinrider", "supply chain" ], "lang": "en", "name": "PolinRider Spreads Through Compromised GitHub Accounts and Packagist", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "published": "2026-09-18T12:51:25.360Z", "references": [ { "external_id": null, "id": "38832148-3ee0-47af-b922-cdf09a67dbbb", "source_name": "alien-vault", "url": "https://socket.dev/blog/polinrider-github-packagist" }, { "external_id": "6aad33cda70ed83efd0e0a73", "id": "6fd32551-3786-459d-a97e-1dc43d12290b", "source_name": "alien-vault", "url": "https://otx.alienvault.com/pulse/6aad33cda70ed83efd0e0a73" } ], "report_types": [ "threat-report" ], "restrict_access": false, "source_url": "https://socket.dev/blog/polinrider-github-packagist" }, "targets": [ { "confidence": 50, "evidence_id": "d8e328f7-eb6a-4e2a-816f-c0a3f0cd35d1", "name": "Technologies", "role": "cible déclarée (relation targets)", "type": "Sector" } ], "techniques": [], "vulnerabilities": [] }, "report_id": "53ad0f19-db8a-4be4-8cad-4798fff331dc", "schema_version": 1, "selected_date": "2026-09-18", "source_url": "https://socket.dev/blog/polinrider-github-packagist" }