North Korea’s “Contagious Interview” Floods npm with 200 New Packages, Using Fake Crypto Jobs to Deploy OtterCookie Spyware

The article discusses a North Korean state-sponsored cyber campaign known as "Contagious Interview," which targets blockchain and Web3 developers by embedding malware in fake coding tests. The Socket Threat Research Team reports that nearly 200 malicious npm packages have been introduced, aimed at stealing cryptocurrency and sensitive information.

The attackers use fake job interviews to lure victims into installing compromised software, with a sophisticated infrastructure that includes malicious GitHub repositories and a command and control server. A notable malware variant, "OtterCookie," is used to execute various malicious activities, including credential theft and surveillance. The campaign poses a significant threat to the Web3 development community, evolving continuously with new infiltrations.