How-North-Korea-Backed-Lazarus-Group-is-Weaponizing-Open-Source-Whitepaper.pdf (8 MB)

Sonatype reports that the North Korea-backed Lazarus Group is abusing open source package ecosystems as part of a strategic software supply-chain campaign. In the first half of 2025, Sonatype’s automated detection identified 234 unique malware packages in open source registries attributed to Lazarus and aimed at software engineers, CI/CD pipelines, and developer environments. The campaign uses npm and PyPI package trust to impersonate legitimate components and deliver multi-stage malware capable of clipboard stealing, credential harvesting, file theft, Windows keylogging, secret exfiltration, and longer-term access. The report highlights a shift toward compromising developer workflows and SDLC infrastructure rather than simply targeting end users or mining cryptocurrency.