North Korean Hackers Compromise Go and PHP Packages

A DPRK-linked supply-chain campaign, PolinRider, compromises GitHub accounts and injects malicious JavaScript into legitimate repositories, which are then published to multiple package registries, including Packagist and Go, without requiring a separate upload credential.