Typosquatting & Backdoors: Lazarus’ Latest npm Campaign

According to Socket Research Team, the Lazarus Group, North Korea’s notorious state-backed cyber threat actor, has infiltrated the npm ecosystem again with a new wave of six malicious packages designed to compromise developer environments, steal credentials, extract cryptocurrency data, and deploy backdoors.

The packages are is-buffer-validator, yoojae-validator, event-handle-package, array-empty-validator, react-event-dependency, and auth-validator, and five of the six pages also had GitHub repositories created to add a layer of legitimacy for unsuspecting developers. The six new packages collectively downloaded over 330 times and closely mimic widely trusted libraries, a typosquatting tactic used by Lazarus-linked threat actors to deceive developers.

As of this report, these malicious packages remain active on the npm registry, pending removal, with affected GitHub repositories and user accounts reported to mitigate further compromise. Lazarus leverages open-source infrastructure to bolster persistence by creating or repurposing GitHub repositories, and the malicious scripts employ self-invoking functions, array shifting, and dynamic function constructors to evade security tools.