Security notice: June 2026 PolinRider malware incident in a number of DHIS2-related repositories. Please read this if you work with DHIS2 frontend code from any source other than apps.dhis2.org, and please share it onward.
Two months ago we found active malware (publicly tracked as PolinRider / Void Dokkaebi / Famous Chollima) sitting inside a number of DHIS2-related frontend repositories. Most of it in third-party / partner repositories, but we want to share that the official dhis2 GitHub org was also briefly hit: on 2026-06-03 an attacker used stolen developer credentials to force-push the loader into a set of dhis2/* repositories. That was caught and fully cleaned within about 24 hours, and the whole org was re-scanned and confirmed clean on 2026-06-04. We focused, at that time, on ensuring that the security incident was resolved for our active developers, and core public code-bases, and that future exploits were prevented.
Crucially, the live App Hub service (apps.dhis2.org) and every app published there were never affected — only source repositories were touched. The earliest infected sample we have goes back to 11 September 2024, so on the third-party side this has been circulating quietly for a long time.
Who should pay attention
You should pay attention if, at any point, you:
- cloned, built, fetched, or just opened in VS Code any of the repositories listed below (see “Affected repositories”);
- installed an npm package with a name like
tailwindcss-style-animate(a typosquat pretending to be a Tailwind plugin); - ran a DHIS2 app on your instance that you got from an informal source (a partner repo, a colleague’s fork, a zip handed to you) rather than from
apps.dhis2.org.
If you only ever install apps from apps.dhis2.org, you are not affected — every app published there has been scanned and is clean.
What it actually does
The malicious code hides inside everyday build and config files — d2.config.js, tailwind.config.js, vite.config.js, postcss.config.mjs, babel.config.js, jest.config.js, .vscode/tasks.json, a .woff2 font that is really JavaScript, and sometimes directly in app source (src/App.js, src/AppWrapper.js, src/index.js). It runs the moment you do something completely normal — npm install, a build or test, or just opening the folder in VS Code (a .vscode/tasks.json with runOn: folderOpen fires on workspace trust, before any build).
Once it runs, it quietly collects the things that hurt the most to lose: browser-saved passwords and cookies, SSH keys, .env files, macOS Keychain entries, crypto wallets, and your GitHub / npm / AWS / GCP / Azure credentials. It can also drop a persistent backdoor so the attacker can come back later. This is the same class of malware behind the recent campaign that compromised GitHub accounts and stole nearly 4,000 private repositories.
A word on the dates: they are forged
Please read this before you reason about “but I cloned that repo before/after date X.” The attacker backdated the malicious commits (clock-rewind), so git log shows fake dates — some as old as 2023 or 2024 on commits that were actually pushed in 2026. The forgery cuts both ways:
- For the
dhis2org, the real exposure was a tight window around 2026-06-03 → 06-04, even though some commits claim 2024/2025 dates. That is why we can give you a strict window there. - For the HISP Uganda repositories the push history is far less reliable, so we cannot give you a safe date range. Treat it as: if you have ever had any of those repos, assume exposure.
Affected repositories
There are three groups. Read the one(s) that apply to you.
Group A — dhis2 GitHub org (strict window: 2026-06-03 → 2026-06-04)
These official dhis2/* source repositories were force-pushed with the loader on 2026-06-03 and cleaned within ~24 hours; the org was re-scanned clean on 2026-06-04.
You are exposed only if you cloned, fetched, pulled, built, or opened one of these between 2026-06-03 and 2026-06-04. If you did, run the self-check below.
| Repository | Carrier / vector | Note |
|---|---|---|
dhis2/capture-app |
config loader | force-push wave |
dhis2/app-management-app |
config loader | also open PR #509 |
dhis2/aggregate-data-entry-app |
config loader | force-push wave |
dhis2/charts-app |
.vscode + .woff2 kit |
also on default branch — see below |
dhis2/cache-cleaner-app |
.vscode + .woff2 kit |
mostly side branches |
dhis2/app-hub |
config loader | the source repo — NOT the live apps.dhis2.org service |
dhis2/approval-app |
config loader | force-push wave |
dhis2/action-semantic-release |
.vscode + .woff2 kit |
GitHub Action — runs in the CI of any repo that uses it |
dhis2/camel-hie-boot |
.vscode + .woff2 kit |
force-push wave |
dhis2/camel-dhis2 |
.vscode + .woff2 kit |
force-push wave |
dhis2/camel-archetype-dhis2 |
.vscode + .woff2 kit |
force-push wave |
dhis2/cancer-registry-app |
source commit | live on default branch — see below |
Two caveats to the strict window:
dhis2/cancer-registry-appcarried the loader on its default branch from about 2026-05-04, so its window starts earlier than the wave.dhis2/charts-appanddhis2/action-semantic-releasealso carried it on their default branches (dates forged, possibly months).action-semantic-releaseis a GitHub Action, so if any of your workflows referenced it, treat that as CI supply-chain reach and pin/clean accordingly.
dhis2/app-hubvsapps.dhis2.org: the source repositorydhis2/app-hubwas caught in the force-push wave, but the live App Hub service and the apps published on it were never affected. Installing apps fromapps.dhis2.orgwas, and is, safe.
Group B — HISP Uganda org (no safe date range — if you ever had these, assume exposure)
All of the following HISP Uganda public repositories carried the loader on their default branch (so anyone who cloned, npm install-ed, built, or opened them was exposed). As explained above, the push dates here are unreliable, so the dates below are best-effort “earliest seen” estimates only — do not treat them as a safe cut-off. If you have ever worked with any of these repos, run the self-check.
| Repository | Carrier file | Earliest seen (estimate — unreliable) |
|---|---|---|
HISP-Uganda/school-licensing-app |
tailwind.config.js |
2024-09-11 (earliest confirmed sample) |
HISP-Uganda/who-did-what |
src/AppWrapper.js |
commit claims 2024-04 (forged) |
HISP-Uganda/cqi2 |
tailwind.config.js |
~2024-09 |
HISP-Uganda/adex-export |
main.js |
~2024-10 |
HISP-Uganda/dhis2-dqa360 |
vite.config.js |
~2025-08 |
HISP-Uganda/moh-registers |
.woff2 kit |
~2025-11 |
HISP-Uganda/hisp-hr-system |
.woff2 kit |
~2026-02 |
HISP-Uganda/covid-service |
utils.js |
~2026-04 |
HISP-Uganda/data-import-wizard-scheduler |
jest.config.js |
~2026-04 |
HISP-Uganda/poe-print |
src/App.js |
~2026-04 |
HISP-Uganda/polio-campaign |
src/AppWrapper.js |
~2026-04 |
HISP-Uganda/SBS-covid-19-dashboard |
src/AppWrapper.js |
~2026-04 |
HISP-Uganda/sia |
tailwind.config.js |
~2026-04 |
HISP-Uganda/sms-configuration-app |
cypress/plugins/index.js, src/index.js |
commit claims 2023 (forged) |
HISP-Uganda/travelcheck |
babel.config.js |
~2026-04 |
HISP-Uganda/vaccination-self-registration-form |
tailwind.config.js |
~2026-04 |
HISP-Uganda/dhis2-public-portal |
apps/portal/postcss.config.mjs |
~2026-05 |
HISP-Uganda/DHIS2-Arsenal |
d2.config.js |
original disclosure (now private/removed) |
Status (as of 2026-06-08): HISP Uganda has cleaned 16 of the 16 public repos above, confirmed by re-scan. Cleaning a repo does not un-expose anyone who already cloned it — the warning above still stands.
Group C — Personal DHIS2-developer repos
These are personal repositories of a DHIS2 developer that were compromised through a stolen credential (the account owner is a victim, not the attacker).
JohanGHole/measlesIGJohanGHole/hiv-tracker-igJohanGHole/tb-tracker-program-igJohanGHole/enable-anc-igJohanGHole/dhis2-patient-enrollment-igJohanGHole/dhis2-rwanda-attribute-harmonizationJohanGHole/dhis2-tb-tracker-ig-tutorialJohanGHole/tracker-tb-case-surveillance-ig
Status (as of 2026-06-08): The public repos above were cleaned, confirmed by re-scan. Cleaning a repo does not un-expose anyone who already cloned it — the warning above still stands.
Attribution note: every account involved here was a victim of credential theft, not the perpetrator. We name repositories so you know what to avoid, not to point fingers at the maintainers.
What you should do
- Run the host-triage self-check for your OS. It is read-only, needs no install, and tells you whether your machine shows signs of the loader having run (see links at the bottom of this post):
- macOS:
polinrider_hunt_macos.sh - Linux:
polinrider_hunt_linux.sh - Windows:
polinrider_hunt_windows.ps1
- macOS:
- If the self-check reports a hit (or you know you built/opened an affected repo on an affected date): rotate your credentials — GitHub, npm, and any cloud (AWS/GCP/Azure) tokens, SSH keys, and browser-saved passwords — and follow the incident steps in the full notice.
- If you maintain or fork any repo in the lists above, scan it before you build it again, and add a CI scan to block re-introduction.
- Do not open a suspected repo in VS Code, and do not run
npm install/ a build /d2-app-scriptsagainst it, until it has been scanned — those are exactly the triggers.
What is NOT affected
The live App Hub at apps.dhis2.organd every app published there.- The official
dhis2org repositories today — they were cleaned and re-verified on 2026-06-04. - Anyone who only ever installs apps from
apps.dhis2.org.
Resources and contact
-
Self-check scripts (macOS / Linux / Windows):
-
Questions, or you think you are affected: security@dhis2.org
Please forward this to anyone you think may have cloned, built, or run any DHIS2 frontend code from a non-official source.
DHIS2 Security team
. It is great to know that if we do face this issue we can reach out to