DPRK's 'Contagious Interview' Spawns Malicious Npm Package Factory

North Korean attackers behind the Contagious Interview campaign have delivered more than 197 malicious npm packages, with over 31,000 collective downloads since Oct 10, as part of ongoing state-sponsored activity to compromise software developers. The latest wave targets blockchain and Web3 developers through fake job interviews and “test assignments,” according to Socket Threat Research.

Since at least June, they have added the delivery of malicious npm packages designed to deliver initial access malware, enabling attackers to deploy further payloads, install a remote access Trojan, and steal credentials and cryptocurrency. Researchers also traced GitHub infrastructure underpinning the activity, including a package called tailwind-magic linked to a threat actor-controlled GitHub account, with staging and deployment flows through Vercel.

Socket researchers describe a coherent adversarial delivery stack where malware-serving code sits on GitHub, payloads are fetched from a separate platform, and a dedicated C2 server handles data collection, reflecting a sustained, pipeline-like operation rather than a one-off hijack.