Loading story…
Researchers reported that the npm package jsonspack was used in a DPRK-linked software supply chain campaign to deliver a multi-tenant Node.js remote access trojan (RAT). The malicious package targeted developers and downstream environments through the open-source ecosystem, turning a seemingly legitimate dependency into an initial access vector. The operation reflects a broader pattern of North Korean threat activity that abuses trusted developer workflows and package repositories to gain footholds inside victim networks.
The malware’s tradecraft aligned with known ATT&CK behaviors including Data Obfuscation (T1001) to conceal command-and-control traffic and Execution Guardrails (T1480) to restrict payload execution to intended targets and reduce exposure during analysis. Those techniques are commonly used to blend malicious communications into normal web activity, compress or encrypt exchanged data, and enforce environment checks before running. Together, the references indicate a carefully controlled supply chain intrusion in which a trojanized Node.js package was used to selectively deploy and operate covert remote access capability.
Trace attribution and downstream blast radius.
1 event from the most recent confirmed update back to the earliest known activity.
Panther published research on a supply-chain campaign involving the npm package jsonspack, describing it as a DPRK-linked Node.js RAT operation. The reference identifies this as the disclosure of the campaign and its tooling.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
3 references tracked. Mallory keeps watching after this page renders.
panther.com
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple **software supply chain** campaigns targeting developers through malicious packages in public repositories, aiming to steal credentials/secrets and establish persistent access that can later impact production environments. Socket disclosed a campaign dubbed **StegaBin** involving **26 malicious npm packages** published over a two-day window that used a Pastebin “dead-drop” with **character-level steganography** to conceal C2 details, then resolved additional infrastructure across **31 Vercel deployments** to deliver platform-specific shell payloads that install a RAT and a **nine-module infostealer** targeting VSCode data, SSH keys, git repositories, browser credential stores, clipboard contents, and other local secrets. Socket assessed the tradecraft as consistent with activity previously attributed to **North Korea-aligned FAMOUS CHOLLIMA (Lazarus-linked)** and noted rapid detection of the packages shortly after publication. Separately, reporting highlighted **four malicious NuGet packages**—`NCryptYo`, `DOMOAuth2_`, `IRAOAuth2.0`, and `SimpleWriter_`—that targeted **ASP.NET** developers by exfiltrating **ASP.NET Identity** data (users/roles/permissions) and enabling backdoors; the packages were published in August 2024, accumulated **4,500+ downloads**, and were later removed. In that campaign, `NCryptYo` functioned as a dropper and proxy to an attacker-controlled C2, while `DOMOAuth2_` and `IRAOAuth2.0` handled data theft and backdoor rule delivery, and `SimpleWriter_` enabled file writing and hidden process execution while masquerading as a PDF utility. Other items in the set described unrelated C2 tooling trends (a Polygon blockchain-based botnet loader and the Vshell C2 framework) and do not describe the same package-repository supply chain incidents.
Jun 29, 2026
North Korea-linked threat actors have significantly expanded the 'Contagious Interview' campaign, targeting software developers in the crypto and Web3 sectors by uploading 197 new malicious npm packages designed to distribute an updated version of the OtterCookie infostealer. These actors, posing as recruiters on platforms like LinkedIn, use sophisticated social engineering tactics such as fake job interviews and trojanized demo projects to lure victims on Windows, Linux, and macOS. The campaign leverages a full delivery infrastructure, including a threat actor–controlled GitHub account and Vercel-hosted staging sites, to store and deliver malware, with command and control servers used for data theft and remote tasking. The campaign's payloads include the BeaverTail and OtterCookie infostealers and the InvisibleFerret RAT, and the malicious npm packages have been downloaded over 31,000 times, highlighting the scale and persistence of the operation. Technical analysis reveals that the attackers have built a robust malware delivery system, using their GitHub account to host repositories and fetch the latest payloads from Vercel, while maintaining separate C2 infrastructure for exfiltration and tasking. At least five npm packages, including 'tailwind-magic' and its variants, have been directly linked to this campaign. The operation demonstrates the increasing sophistication of North Korean supply chain attacks, with a focus on compromising developers in high-value sectors through open-source ecosystems. Security researchers continue to monitor the evolving tactics and infrastructure associated with this campaign, warning organizations and developers to exercise heightened vigilance when interacting with unsolicited job offers and npm packages.
Jun 29, 2026
Researchers reported the **first confirmed appearance of the PylangGhost remote access trojan on the npm registry**, where it was hidden in two malicious JavaScript packages: `@jaime9008/math-service` and `react-refresh-update`. The activity has been linked to **FAMOUS CHOLLIMA**, a North Korean state-sponsored threat group previously associated with developer-focused social engineering and trojanized software campaigns. The packages were reportedly uploaded by the user `jaime9008`, tied to the email `jaimeandujo086[@]gmail.com`, and contained a PylangGhost loader embedded in files including `runtime.js`, `babel.js`, and `lib/lib.js`. The reported campaign used the hardcoded identifier **"ML2J"** and communicated with infrastructure including `malicanbur[.]pro` and `173.211.46[.]22:8080`. The reporting indicates the npm activity represents an escalation of software supply chain targeting aimed at developers and development pipelines, extending a malware family that had previously been disclosed by Cisco Talos and attributed to the same DPRK-linked actor. A social post amplifying the Kmsec finding is consistent with that same event, while separate posts about **Konni** spear-phishing and KakaoTalk-linked activity describe a different DPRK-related campaign and are not part of this incident.
Jun 29, 2026