North Korean “StegaBin” Campaign Targets Developers with Steganographic Malware

Socket researchers uncovered "StegaBin," a sophisticated supply-chain malware campaign by North Korean–aligned FAMOUS CHOLLIMA that used 26 malicious npm packages and character-level steganography in Pastebin essays to hide C2 addresses; the packages typosquatted popular libraries and included legitimate dependencies to avoid breaking developer projects while a nine-module toolkit harvested VSCode persistence data, SSH keys, git repos, browser credentials, clipboard contents, and crypto wallets.