Bogus npm Packages Used to Trick Software Developers into Installing Malware

Securonix and other security firms are tracking DEV#POPPER, a social-engineering campaign that impersonates employers in fake job interviews to coerce developers into downloading malicious npm packages or GitHub-hosted ZIPs. The delivered payloads include a Node.js information stealer called BeaverTail and a Python backdoor named InvisibleFerret, enabling data theft, command execution, file exfiltration, and keystroke/clipboard logging; reporting links this activity to North Korean APTs such as groups associated with Lazarus.