Neutralinojs Compromised In DPRK Attack

**Neutralinojs supply-chain compromise (2026-03-02):** DPRK-linked actors used a compromised GitHub account to force-push backdated commits that injected obfuscated JavaScript payloads which fetch a multi-stage BeaverTail infostealer via a blockchain-based C2; four Neutralinojs repositories were directly infected, two Vercel-hosted C2 endpoints were identified and taken down, and similar payloads have been found in 106+ additional repositories, posing a high risk to developers who clone or build from source.