North Korean Actors Expand Contagious Interview Campaign with New Malware Loader

Socket researchers observed North Korean-linked Contagious Interview actors expanding a software supply-chain campaign on the npm registry by publishing dozens of malicious packages using a new loader, XORIndex (and reusing HexEval), which collects host telemetry and stages BeaverTail and InvisibleFerret to exfiltrate cryptocurrency wallets and credentials; thousands of downloads were recorded and multiple packages remain live while takedown requests are underway.