Lazarus is reported to have distributed six malicious npm packages through typosquatting and package impersonation, exposing developers to credential theft, sensitive data collection, backdoor installation, and malicious code execution during software builds. The campaign is a supply-chain threat because compromised developer environments can propagate risk into applications and downstream users who trust packages pulled from the npm ecosystem.