Lazarus Hackers Use 234 Weaponized npm and PyPI Packages to Target Developers

### Executive summary Sonatype identified a sophisticated Lazarus Group supply-chain campaign (Jan–Jul 2025) that planted 234 malicious packages on npm and PyPI designed to harvest credentials, profile developer hosts, and install persistent backdoors; the firm blocked these packages and estimated over 36,000 potential victims, highlighting a strategic shift by the nation-state actor toward long-term infiltration of developer ecosystems.