Loading story…
A malicious npm campaign used the account gemini-check to publish trojanized packages including gemini-ai-checker, express-flowlimit, and chai-extensions-extras, disguising them as legitimate developer utilities while delivering a staged JavaScript payload from Vercel-hosted infrastructure. Researchers linked the malware to OtterCookie, a modular Node.js backdoor associated with the DPRK-linked Contagious Interview activity cluster, citing overlaps in payload design, remote access capability, and data-theft behavior. The packages were downloaded more than 500 times in total, and while gemini-ai-checker was removed, the other packages were still available at the time of reporting.
The malware executed code in memory to reduce detection and then stole browser credentials, cryptocurrency wallets, files, clipboard contents, and developer secrets. It also explicitly targeted directories tied to AI coding tools including Cursor, Claude, Gemini CLI, Windsurf, PearAI, and Eigent, enabling theft of API tokens, conversation logs, source code, SSH keys, and cloud credentials. The campaign shows a software supply-chain intrusion aimed directly at developers, with a particular focus on compromising AI-assisted development environments and the sensitive access they contain.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
By the time of later reporting, the three malicious npm packages had accumulated more than 500 total downloads, indicating measurable exposure among developers.
Public reporting assessed the malicious npm campaign with moderate-high confidence as linked to the DPRK-associated Contagious Interview threat activity based on strong similarities to OtterCookie malware and shared tradecraft.
Researchers found the npm campaign delivered a multi-module backdoor closely resembling OtterCookie, capable of remote access, credential theft, file exfiltration, clipboard monitoring, and theft of data from AI coding tools including Cursor, Claude, Gemini CLI, Windsurf, PearAI, and Eigent.
By shortly before April 1, the gemini-ai-checker package had been taken down from npm, while the related packages express-flowlimit and chai-extensions-extras remained available.
The threat actor also operated the npm packages express-flowlimit and chai-extensions-extras, which used the same Vercel-hosted staging infrastructure to fetch and execute remote JavaScript payloads.
A malicious npm package named gemini-ai-checker was published under the account "gemini-check," posing as a Google Gemini token verification utility while delivering malware to developers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
infosec.pub
Open sourcecybersecuritynews.com
Open sourcecyberandramen.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a broad software supply chain campaign targeting developers and cryptocurrency users through hijacked packages, browser extensions, and compromised maintainer accounts across ecosystems including **npm**, **Go**, **Chrome**, and **Packagist**. Socket linked the activity to North Korean actors associated with the **Contagious Interview** operation and identified 108 malicious packages and extensions spanning 162 release artifacts, while JFrog separately analyzed hijacked npm packages `html-to-gutenberg` `4.2.11` and `fetch-page-assets` `1.2.9` that were uploaded with malicious code. The activity appears to rely on account hijacking rather than compromise of GitHub itself, and some attacker infrastructure reportedly remains active even after certain packages were removed. The malware chain used unusual delivery and evasion techniques aimed at developer workstations, including a **VS Code folder-open task** instead of standard npm lifecycle scripts, JavaScript hidden in a fake font file, and encrypted payload retrieval from blockchain transaction data on **TRON**, **Aptos**, and **BNB Smart Chain**. Researchers said the campaign deployed components including **BeaverTail**, **DEV#POPPER RAT**, **OmniStealer**, a `socket.io` backdoor, and a Python infostealer to steal browser credentials, password-manager contents, cryptocurrency wallet data, developer secrets, and operating system credential-store material across **Windows**, **macOS**, and **Linux**. Security firms warned that affected developer systems and credentials should be treated as fully compromised.
Jul 9, 2026
North Korea-linked threat actors have significantly expanded the 'Contagious Interview' campaign, targeting software developers in the crypto and Web3 sectors by uploading 197 new malicious npm packages designed to distribute an updated version of the OtterCookie infostealer. These actors, posing as recruiters on platforms like LinkedIn, use sophisticated social engineering tactics such as fake job interviews and trojanized demo projects to lure victims on Windows, Linux, and macOS. The campaign leverages a full delivery infrastructure, including a threat actor–controlled GitHub account and Vercel-hosted staging sites, to store and deliver malware, with command and control servers used for data theft and remote tasking. The campaign's payloads include the BeaverTail and OtterCookie infostealers and the InvisibleFerret RAT, and the malicious npm packages have been downloaded over 31,000 times, highlighting the scale and persistence of the operation. Technical analysis reveals that the attackers have built a robust malware delivery system, using their GitHub account to host repositories and fetch the latest payloads from Vercel, while maintaining separate C2 infrastructure for exfiltration and tasking. At least five npm packages, including 'tailwind-magic' and its variants, have been directly linked to this campaign. The operation demonstrates the increasing sophistication of North Korean supply chain attacks, with a focus on compromising developers in high-value sectors through open-source ecosystems. Security researchers continue to monitor the evolving tactics and infrastructure associated with this campaign, warning organizations and developers to exercise heightened vigilance when interacting with unsolicited job offers and npm packages.
Jun 29, 2026
Security researchers reported a coordinated campaign targeting high-impact **Node.js** and **npm** maintainers through social engineering, with the activity described as focused on influential open-source developers whose accounts or packages could provide broad downstream access. Public reporting tied the operation to attempts to compromise trusted maintainers in the JavaScript ecosystem, including references to widely used projects such as **Axios**, raising concern over software supply chain exposure if attacker access were obtained. Separate reporting also tracked an **OtterCookie** infostealer campaign operating across **npm**, linking the malware activity to the same broader threat context and associating it with **DPRK**-aligned tradecraft. The combined reporting indicates an effort to use maintainer targeting and malicious npm activity to steal credentials, compromise developer environments, and potentially abuse trusted package distribution channels for follow-on supply chain attacks.
Jul 1, 2026