North Korean XORIndex malware hidden in 67 malicious npm packages

North Korean state-backed actors in the ‘Contagious Interview’ campaign uploaded 67 malicious npm packages (around 17,000 downloads) that use postinstall scripts to deploy the XORIndex loader (and previously HexEval) to profile hosts and retrieve JavaScript payloads (BeaverTail, InvisibleFerret) from a Vercel-hosted C2; these backdoors and information stealers enable persistent access and data exfiltration, and defenders are advised to vet packages, check publishers, review source code for obfuscation, and test libraries in isolated environments.