Stressed Pungsan: DPRK-aligned threat actor leverages npm for initial access

Datadog Security Labs discovered two near-identical malicious npm packages that abuse npm preinstall scripts to drop a DLL from http://142.111.77.196 and execute it via rundll32, a supply-chain technique attributed to a DPRK-aligned cluster (MOONSTONE SLEET / “Stressed Pungsan”). The delivered DLL exports GenerateKey/GenerateKeyW but showed no active malicious behavior in analysis; the report includes the IP and SHA256 indicators and recommends investigation, credential rotation, and isolation if impacted.