jsonspack: Multi-Tenant Node.js RAT — DPRK Supply Chain Campaign

Campaign - Panther | The Security Monitoring Platform for the Cloud

Note — jsonspack vs legitimate jsonpack : jsonpack is a legitimate npm JSON compression library published by sapienlab in 2013, maintained through 2022, with 1.1.5 as the final version.P2 (Footnote prefixes:

E = evidence, P = prior art, R = references, A = appendix.) It is unrelated to this campaign. The operator chose jsonspack[.]com as a plausible-sounding developer tooling brand — not a deliberate typosquat (npm package names must be unique), but capitalising on the superficial similarity to a real package name for credibility. Campaign Overview

The jsonspack campaign is a supply chain attack compri…