North Korean Hackers Publish 26 npm Packages Hiding Pastebin C2 for Cross-Platform RAT

Researchers disclosed a North Korean APT supply‑chain campaign (tracked as "StegaBin" / part of Contagious Interview) that published 26 typosquatting npm packages containing install-time loaders which decode Pastebin steganography to obtain Vercel-hosted C2s and deliver multi-platform credential-stealers and a RAT. The malware provides VS Code persistence, keylogging and clipboard theft, browser and crypto-wallet credential theft, TruffleHog-based secret scanning, Git/SSH exfiltration, and remote-control capabilities; infrastructure includes 31 Vercel deployments and active C2 IPs and ports.