North Korean Hackers Target Developers with 338 Malicious Software Packages

North Korean threat actors are escalating a Contagious Interview campaign thatdeploys 338 malicious npm packages with over 50,000 downloads to target cryptocurrency and blockchain developers. The operation uses more than 180 fake personas and a dozen command and control endpoints to deliver advanced malware including BeaverTail and InvisibleFerret backdoors.

Security researchers have identified this as a factory‑style operation designed to compromise developer endpoints and steal cryptocurrency assets, with a systematic approach based on the Lockheed Martin Cyber Kill Chain framework. Threat actors begin with reconnaissance on LinkedIn, posing as recruiters or hiring managers and screening targets for technical expertise and financial potential before victims install seemingly legitimate dependencies.

A recent case involved a software engineer receiving a repository containing the malicious “eslint-detector” package, which appeared to be part of a recruitment test but contained encrypted payloads designed to steal credentials and wallet data. The campaign targets the Node.js and Express ecosystem and uses typosquatted versions of popular packages and brand impersonation to blend into routine developer workflows. 13 October 2025.