Scan a project or machine for the PolinRider DPRK/Lazarus supply-chain malware (March–April 2026 npm + VS Code campaign). Use whenever the user asks to scan, audit, or check for PolinRider, the postcss / tailwind / webpack / next config infection, the tempautopush.bat / config.bat propagation, the StakingGame .vscode/tasks.json dropper (UUID e9b53a7c-2342-4b15-b02d-bd8b8f6a03f9), or any IOC listed in references/iocs.md. Trigger proactively when the user reports unexplained node -e processes, createRequire showing up in simple ESM build configs, unfamiliar tailwindcss--animate packages in package.json or lockfiles, .vscode/tasks.json with runOn: folderOpen, font files that read as plain text, or .bat files appearing in JavaScript repo roots. Also trigger when the user mentions the DPRK / Lazarus npm supply-chain attack or the OpenSourceMalware/PolinRider repository.
Install with
Claude CodeCodexCursorGitHub CopilotGemini CLI
Supported by the Atlas install prompt. Skill-specific requirements vary.
Skill stats
Skills1CategorySecurityStars0
About this skill
Scan a project or machine for the PolinRider DPRK/Lazarus supply-chain malware (March–April 2026 npm + VS Code campaign). Use whenever the user asks to scan, audit, or check for PolinRider, the postcss / tailwind / webpack / next config infection, the tempautopush.bat / config.bat propagation, the StakingGame .vscode/tasks.json dropper (UUID e9b53a7c-2342-4b15-b02d-bd8b8f6a03f9), or any IOC listed in references/iocs.md. Trigger proactively when the user reports unexplained node -e processes, createRequire showing up in simple ESM build configs, unfamiliar tailwindcss--animate packages in package.json or lockfiles, .vscode/tasks.json with runOn: folderOpen, font files that read as plain text, or .bat files appearing in JavaScript repo roots. Also trigger when the user mentions the DPRK / Lazarus npm supply-chain attack or the OpenSourceMalware/PolinRider repository.
Quick start
Copy the install prompt. Use the green button above this README.
Send it to your agent. Paste it into your coding agent’s chat and send.
Review the setup. Your agent checks the skill’s instructions, requirements, and installation scope.
Scan a project or machine for the PolinRider DPRK/Lazarus supply-chain malware (March–April 2026 npm + VS Code campaign). Use whenever the user asks to scan, audit, or check for PolinRider, the postcss / tailwind / webpack / next config infection, the `temp_auto_push.bat` / `config.bat` propagation, the StakingGame `.vscode/tasks.json` dropper (UUID `e9b53a7c-2342-4b15-b02d-bd8b8f6a03f9`), or any IOC listed in `references/iocs.md`. Trigger proactively when the user reports unexplained `node -e` processes, `createRequire` showing up in simple ESM build configs, unfamiliar `tailwindcss-*-animate*` packages in `package.json` or lockfiles, `.vscode/tasks.json` with `runOn: folderOpen`, font files that read as plain text, or `*.bat` files appearing in JavaScript repo roots. Also trigger when the user mentions the DPRK / Lazarus npm supply-chain attack or the `OpenSourceMalware/PolinRider` repository.
About this listing
Category
Security
Reported license
Not specified
Listing language (estimated)
English
Review status
Not individually reviewed
Agent compatibility
Atlas installation supports Claude Code, Codex, and Cursor. Skill-specific dependencies and features are checked during setup.
Claude Code
Codex
Cursor
GitHub Copilot
Gemini CLI