Lazarus Graphalgo Fake-Recruiter Campaign Using Malicious npm and PyPI Packages

North Korea-linked Lazarus Group has been tied to an expanded “fake recruiter” operation targeting cryptocurrency-sector Python and JavaScript developers by luring them with job offers and coding assessments that require installing trojanized dependencies from npm and PyPI. ReversingLabs reports the activity has been ongoing since May 2025 and uses a multi-stage, modular infection chain that hides malicious functionality behind layers of indirection across public services such as GitHub, npm, and PyPI, helping the operation persist even as individual components are removed.

The campaign (codenamed Graphalgo) reportedly uses a “bait-and-switch” approach in which initially benign packages build trust and download volume before later versions introduce malicious payloads; one highlighted npm package, bigmathutils, exceeded 10,000 downloads prior to the malicious update. Reported package names associated with the operation include npm packages such as graphalgo, graphlibcore, and bigmathutils, and PyPI packages such as graphalgo, graphlibx, and bigmathutils; the threat actors also create supporting legitimacy artifacts (e.g., a purported crypto firm like Veltrix Capital, related domains, and GitHub organizations/repositories) to make the recruitment workflow appear authentic and to deliver the compromised projects used in “assessments.”