Lazarus Group’s ‘Graphalgo’ Fake Recruiter Campaign Targets GitHub, npm, and PyPI to Spread Malware

ReversingLabs links a Lazarus Group operation called "graphalgo" to a developer‑targeted software supply‑chain campaign that used fake recruiter postings and a fabricated company (Veltrix Capital) to distribute malicious npm/PyPI packages (notably bigmathutils and graphnetworkx). The packages acted as first‑stage loaders that fetched a RAT with token‑protected C2, capable of file transfers, command execution, and checks for MetaMask—indicating a focused effort to compromise crypto developers and steal assets.