The Malware Factory: Unmasking the 108-Package North Korean Siege on npm

Panther Threat Research uncovered a 30-day, large-scale npm supply-chain malware campaign linked to North Korean actors that used 108 malicious packages (261 versions) to infiltrate developer and CI/CD systems, exfiltrate crypto keys, cloud/DevOps secrets, and AI workflow data, and establish persistent access via techniques including blockchain-based dead-drops and trojanized libraries.