The 1,700-Package Blitz: North Korea’s “Contagious Interview” Infiltrates Every Major Dev Registry

Socket researchers uncovered an expanded "Contagious Interview" campaign linked to North Korea that has published over 1,700 malicious packages across npm, PyPI, Go, Rust, and Packagist; the packages impersonate legitimate developer tooling and act as loaders that rewrite Google Drive links, fetch ZIP archives, and deliver platform-specific second-stage payloads while using a cloned-project GitHub persona (maxcointech1010) to provide social proof.