Malicious NPM Packages Spread PylangGhost RAT in Supply Chain Attack

Malicious npm packages (react-refresh-update 1.0.1–1.0.4 and @jaime9008/math-service 1.0.1–1.0.2) were used to stage the PylangGhost Python RAT—attributed to the North Korean‑linked Famous Chollima/Lazarus ecosystem—by embedding an obfuscated JavaScript loader that decodes, XOR‑decrypts, and executes a downloader which retrieves platform‑specific archives from malicanbur.pro and connects to 173.211.46.22:8080; the campaign targets developer workstations and CI pipelines across Windows, Linux, and macOS and includes actionable IOCs and mitigation recommendations (remove/pin bad versions, block domains/IPs, hunt for start.vbs/macspatch.sh, and scan for PylangGhost modules).