Loading story…
Researchers tied a cluster of malicious npm packages to FAMOUS CHOLLIMA, linking typo-squatted and fake utility libraries including bigmathix, bigmathex, bignumx, bigmathutils, axios-net, some-promise, and json-ptype to a broader campaign aimed at developers, particularly in the cryptocurrency sector. ReversingLabs reported the activity as part of a fake recruiter operation targeting crypto developers, while separate analysis showed the packages delivered a multi-stage Node.js malware chain that ultimately installed a cross-platform JavaScript RAT capable of command execution, file theft, persistence on Windows, Linux, and macOS, self-deletion, and checks for the MetaMask browser extension.
Multiple operational security failures exposed details of the operators’ workflow. Analysts found a stray Windows .lnk file embedded in packages published in May and June 2025, revealing a VMware-based build environment and a shared folder path tied to package development, while another package exposed an err.log file showing a Windows host, the username dvant, Node.js v22.19.0, and a local path suggesting direct modification of the legitimate any-promise package. A separate leaked ordinary.txt reference file contained commented test code, localhost references to port 4444, and logic for evaluating server-supplied content, reinforcing assessments that the same DPRK-linked operator or closely coordinated team reused infrastructure, payloads, and naming patterns across the npm supply-chain campaign.
Trace attribution and downstream blast radius.
19 events from the most recent confirmed update back to the earliest known activity.
The npm user jacksonroman338 released bigmathix version 1.0.2, which contained a downloader for a multi-stage malware chain ending in a cross-platform JavaScript RAT.
The repository omaringram1/bigmathutils had a commit dated with a UTC+9 timestamp and contained commented-out malicious injection points in big.js. This indicated active development of the BigSquatRat package set.
npm revoked the attacker-controlled packages bigmathex and bignumx, removing two earlier packages associated with the BigSquatRat cluster.
The npm package bigmathix published benign versions 1.0.0 and 1.0.1, impersonating the legitimate big.js package before the malicious update appeared.
The GitHub repository jacksonroman338/bigmathix contained a single commit dated with a UTC+9 timestamp. This repository was linked to the later malicious bigmathix npm package.
The attacker-linked repository krystalreeves85/bigmathex had a commit dated with a UTC+9 timestamp and the message "obfuscate the code." The repo was identified as a predecessor in the BigSquatRat campaign.
The npm package bigmathex was first released as part of the attacker-controlled package set associated with BigSquatRat.
The npm package bignumx was created in November 2025 as part of the cluster of likely attacker-controlled packages tied to the BigSquatRat campaign.
The GitHub repositories ryanthompson4323/axios-net and shanbennet322/express each had single commits with UTC+9 timestamps. These repositories were later used by the BigSquatRat malware chain as remote content sources in decryption logic.
The packages dragon0905-vite-tsconfig-assistant version 1.0.3 and vite-tsconfig-assistant version 1.0.3 were released, marking the latest listed packages containing the exposed ordinary.txt file.
The malicious package vite-jsconfig versions 0.3.2 and 0.3.3 were released and still contained the exposed ordinary.txt reference file. The article notes the real payload in vite-jsconfig differed from ordinary.txt by evaluating remote content directly and omitting validation steps.
npm user pavlo123123 uploaded the package some-promise, a malicious derivative of any-promise. It contained a postinstall script that launched an embedded obfuscated payload identified as a partially deobfuscated OTTERCOOKIE sample.
Malicious npm packages attributed to FAMOUS CHOLLIMA began exposing the ordinary.txt JavaScript reference file, which contained commented-out code, localhost testing against port 4444, and eval logic for server-supplied content.
The malicious npm packages nextjs-babel-toastify versions 1.0.7 and 1.1.7 and react-babel-purify version 1.0.7 were published by alias meirjacob. They reused the same infection sample and next-stage infrastructure seen across the cluster.
The malicious npm package vite-plugin-next-refresh version 1.1.2 was published by alias pablomendes as part of the same FAMOUS CHOLLIMA-linked npm campaign.
The malicious npm packages vite-plugin-purify version 2.3.4 and nextjs-insight version 1.1.0 were published by alias bappda. Both were part of the same package cluster reusing identical payload and infrastructure.
The malicious npm package vite-plugin-style-svg version 2.3.4 was published under the same FAMOUS CHOLLIMA-linked cluster that reused the same payload sample and staging infrastructure.
The malicious npm package logbin-nodejs version 2.3.4 was published by alias abdulrahman_nasser. A Windows LNK file later found in this package exposed VMware shared-folder paths from the operator environment.
The malicious npm package logs-buffer version 6.14.8 was published by alias badr705. It was later linked to a FAMOUS CHOLLIMA cluster that reused the same payload and infrastructure across packages.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 22 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
4 references tracked. Mallory keeps watching after this page renders.
kmsec.uk
Open sourcekmsec.uk
Open sourcereversinglabs.com
Open sourcekmsec.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported the **first confirmed appearance of the PylangGhost remote access trojan on the npm registry**, where it was hidden in two malicious JavaScript packages: `@jaime9008/math-service` and `react-refresh-update`. The activity has been linked to **FAMOUS CHOLLIMA**, a North Korean state-sponsored threat group previously associated with developer-focused social engineering and trojanized software campaigns. The packages were reportedly uploaded by the user `jaime9008`, tied to the email `jaimeandujo086[@]gmail.com`, and contained a PylangGhost loader embedded in files including `runtime.js`, `babel.js`, and `lib/lib.js`. The reported campaign used the hardcoded identifier **"ML2J"** and communicated with infrastructure including `malicanbur[.]pro` and `173.211.46[.]22:8080`. The reporting indicates the npm activity represents an escalation of software supply chain targeting aimed at developers and development pipelines, extending a malware family that had previously been disclosed by Cisco Talos and attributed to the same DPRK-linked actor. A social post amplifying the Kmsec finding is consistent with that same event, while separate posts about **Konni** spear-phishing and KakaoTalk-linked activity describe a different DPRK-related campaign and are not part of this incident.
Jun 29, 2026
Security researchers reported multiple **software supply chain** campaigns targeting developers through malicious packages in public repositories, aiming to steal credentials/secrets and establish persistent access that can later impact production environments. Socket disclosed a campaign dubbed **StegaBin** involving **26 malicious npm packages** published over a two-day window that used a Pastebin “dead-drop” with **character-level steganography** to conceal C2 details, then resolved additional infrastructure across **31 Vercel deployments** to deliver platform-specific shell payloads that install a RAT and a **nine-module infostealer** targeting VSCode data, SSH keys, git repositories, browser credential stores, clipboard contents, and other local secrets. Socket assessed the tradecraft as consistent with activity previously attributed to **North Korea-aligned FAMOUS CHOLLIMA (Lazarus-linked)** and noted rapid detection of the packages shortly after publication. Separately, reporting highlighted **four malicious NuGet packages**—`NCryptYo`, `DOMOAuth2_`, `IRAOAuth2.0`, and `SimpleWriter_`—that targeted **ASP.NET** developers by exfiltrating **ASP.NET Identity** data (users/roles/permissions) and enabling backdoors; the packages were published in August 2024, accumulated **4,500+ downloads**, and were later removed. In that campaign, `NCryptYo` functioned as a dropper and proxy to an attacker-controlled C2, while `DOMOAuth2_` and `IRAOAuth2.0` handled data theft and backdoor rule delivery, and `SimpleWriter_` enabled file writing and hidden process execution while masquerading as a PDF utility. Other items in the set described unrelated C2 tooling trends (a Polygon blockchain-based botnet loader and the Vshell C2 framework) and do not describe the same package-repository supply chain incidents.
Jun 29, 2026
SafeDep identified a malicious npm supply-chain campaign that hid the `ulid-xyz` remote-access trojan three levels deep in a dependency chain. The operation used `ioredis-xyz`, a near-copy of the legitimate `ioredis` client, which depended on the nonfunctional relay package `redis-type-xyz`; version `1.10.6` of that relay then introduced `ulid-xyz` within a permissive version range. The payload's malicious `postinstall` hook established WebSocket command-and-control, conducted host and filesystem reconnaissance, accepted operator-provided binaries, and persisted as `MicrosoftSystem64` across Windows, macOS, and Linux. npm removed `ulid-xyz` on August 25, 2026. Infrastructure and operational overlaps—including port `8010`, Hetzner-hosted infrastructure, shared persistence naming, and repository ownership—provide moderate-to-strong circumstantial links to the DPRK-linked **FAMOUS CHOLLIMA** / Contagious Interview cluster. No second-stage payload was found in the analyzed package archives, and the public attribution remains unconfirmed; however, organizations using the affected dependency chain should audit lockfiles and build artifacts for `ioredis-xyz`, `redis-type-xyz`, and `ulid-xyz`, and investigate systems for the `MicrosoftSystem64` persistence artifact and unexpected WebSocket traffic.
Sep 2, 2026