Lazarus Campaign Plants Malicious Packages in npm and PyPI Ecosystems

Researchers uncovered a coordinated campaign (graphalgo) using fake recruitment lures and malicious packages on npm and PyPI linked to the North Korea–associated Lazarus Group to deliver a modular RAT with token-based C2; separate npm incidents include the duer-js package deploying Bada Stealer and an XPACK extortion campaign abusing HTTP 402 to force payments.