North Korean APT “Contagious Interview” Floods npm Registry with 338 Malicious Packages to Steal Crypto

On 11 October 2025, the Socket Threat Research Team warned of a wave of malicious npm activity linked to North Korean threat actors under the Contagious Interview operation. Since July 2025, researchers have identified and analysed more than 338 malicious packages on the npm registry, collectively exceeding 50,000 downloads, with 25 of these packages remaining live at the time of writing.

The campaign blends social engineering and supply-chain compromise, using fake LinkedIn job offers to lure developers into installing malicious dependencies. The attackers impersonate recruiters, delivering a “coding assignment” that conceals a malicious npm package, and employ typosquatted names such as epxresso and dotevn to pass casual inspection. Once installed, the loaders decrypt in memory, fetch BeaverTail, and deploy the InvisibleFerret backdoor for persistence across Windows, macOS, and Linux.

According to Socket, the operation also targets Web3 and crypto developers, with monetisation aimed at cryptocurrency theft and credential compromise, and has reportedly seen substantial losses in 2025.