Socket

2026-07-28

Socket

Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan

#DevPopper #PolinRider #NPM #SupplyChain #OmniStealer #T1195.002 #T1027 #T1027.013 #T1059.007 #T1059.006 #T1059.004 #T1071.001 #T1105 #T1115 #Joyfill

2026-07-01

Socket

PolinRider: North Korea-Linked Supply Chain Campaign Expands Across Open Source Ecosystems

#PolinRider #OmniStealer #SupplyChain

2026-06-17

Socket

140+ Mastra npm Packages Compromised in Coordinated Supply Chain Attack

#Mastra #NPM #SupplyChain #T1195 #T1059 #T1053 #T1105 #T1547 #T1005

2026-05-31

Socket

Famous Chollima Targets PHP Developers Through Compromised Packagist Package

#FamousChollima #ContagiousInterview #SupplyChain #T1195.002 #T1204.002 #T1059.007 #T1027 #T1102.001 #T1105

2026-04-07

Socket

North Korea’s Contagious Interview Campaign Spreads Across 5 Ecosystems, Delivering Staged RAT Payloads

#ContagiousInterview

2026-04-03

Socket

Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign

#Axios #NPM

2026-04-02

Socket

Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise

#Axios #NPM

2026-04-01

Socket

The Hidden Blast Radius of the Axios Compromise

#Axios #NPM

2026-03-31

Socket

Supply Chain Attack on Axios Pulls Malicious Dependency from npm

#Axios #NPM

2026-02-27

Socket

StegaBin: 26 Malicious npm Packages Use Pastebin Steganograp...

#ContagiousInterview #FamousChollima #NPM #Steganography #StegaBin

2025-11-26

Socket

Inside the GitHub Infrastructure Powering North Korea’s Contagious Interview npm Attacks

#ContagiousInterview #NPM #OtterCookie #T1204.005 #T1036 #T1555.001 #T1587 #T1583.006 #T1082 #T1119 #T1585 #T1547.001 #T1005 #T1059.007 #T1587.001 #T1539 #T1041 #T1113 #T1656 #T1608.001 #T1204.002 #T1571 #T1105 #T1195.002 #T1115 #T1083 #T1583.001 #T1497 #T1546.016 #T1555.003 #T1056.001 #T1657 #T1217

2025-10-10

Socket

North Korea’s Contagious Interview Campaign Escalates: 338 Malicious npm Packages, 50,000 Downloads

#ContagiousInterview #NPM #T1119 #T1005 #T1059.007 #T1082 #T1083 #T1555.001 #T1041 #T1027.013 #T1546.016 #T1608.001 #T1204.002 #T1555.003 #T1105 #T1657 #T1217 #T1195.002

2025-07-15

Socket

Contagious Interview Campaign Escalates With 67 Malicious npm Packages and New Malware Loader

#ContagiousInterview #NPM #XORIndex #T1119 #T1005 #T1059.007 #T1082 #T1083 #T1555.001 #T1041 #T1027.013 #T1546.016 #T1608.001 #T1204.002 #T1555.003 #T1105 #T1657 #T1217 #T1195.002

2025-06-25

Socket

Another Wave: North Korean Contagious Interview Campaign Drops 35 New Malicious npm Packages

#BeaverTail #ContagiousInterview #HexEval #NPM #T1119 #T1005 #T1059.007 #T1082 #T1083 #T1555.001 #T1041 #T1027.013 #T1546.016 #T1608.001 #T1204.002 #T1555.003 #T1056.001 #T1105 #T1657 #T1217 #T1195.002

2025-04-04

Socket

Lazarus Expands Malicious npm Campaign: 11 New Packages Add Malware Loaders and Bitbucket Payloads

#BeaverTail #ContagiousInterview #Lazarus #NPM

Published Reports

Top Tags

Top Actors

Cluster Coverage

Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan

PolinRider: North Korea-Linked Supply Chain Campaign Expands Across Open Source Ecosystems

140+ Mastra npm Packages Compromised in Coordinated Supply Chain Attack

Famous Chollima Targets PHP Developers Through Compromised Packagist Package

North Korea’s Contagious Interview Campaign Spreads Across 5 Ecosystems, Delivering Staged RAT Payloads

Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign

Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise

The Hidden Blast Radius of the Axios Compromise

Supply Chain Attack on Axios Pulls Malicious Dependency from npm

StegaBin: 26 Malicious npm Packages Use Pastebin Steganograp...

Inside the GitHub Infrastructure Powering North Korea’s Contagious Interview npm Attacks

North Korea’s Contagious Interview Campaign Escalates: 338 Malicious npm Packages, 50,000 Downloads

Contagious Interview Campaign Escalates With 67 Malicious npm Packages and New Malware Loader

Another Wave: North Korean Contagious Interview Campaign Drops 35 New Malicious npm Packages

Lazarus Expands Malicious npm Campaign: 11 New Packages Add Malware Loaders and Bitbucket Payloads