North Korean Hackers Deploy 338 Malicious NPM Packages

State-sponsored hackers from North Korea have escalated their cyber warfare campaign by deploying 338 malicious npm packages.

These packages have been downloaded over 50,000 times, and it is one of the largest supply chain attacks ever documented against developers.

According to research by Socket, the North Korean operatives have weaponized the development tools programmers trust by embedding advanced malware directly into software repositories. The Contagious Interview operation marks a new tier in nation-state cyberattacks, zeroing in on cryptocurrency and blockchain developers through sharp social engineering.

The analysis reveals these actors run a factory-style operation with over 180 fake personas and multiple command centers. They are not just stealing data, they are potentially accessing corporate secrets, cryptocurrency wallets, and sensitive development environments across thousands of organizations worldwide.

How cybercriminals turn job interviews into cyber weapons

These operators perfected a chilling strategy that leans on something every developer knows well, job hunting. It starts on LinkedIn, where state-sponsored operatives pose as recruiters and target cryptocurrency developers, Web3 engineers, and blockchain specialists with offers that look almost too good to ignore.

Once they find a match, the fake recruiters send coding assignments that mimic real technical interviews but hide malicious dependencies. Security teams discovered that one recent victim received a repository containing the malicious eslint-detector package. It looked like a routine take-home test, yet it was packed with encrypted payloads designed to steal credentials and wallet data.

The trick works because it exploits trust. Developers expect to download and test code during interviews. These operators push victims to run code outside containerized environments and ask for screen sharing during execution, a move that helps the malware slip past security sandboxes. The approach was so effective that Socket analysts identified the campaign after multiple victims reported falling for the bogus job pitches.

Technical breakthrough

North Korean hackers hit a technical milestone with their latest malware, moving beyond simple droppers to encrypted loaders built to evade detection. The newest wave includes encrypted loaders that utilize Node.js crypto functions with hardcoded AES-256-CBC keys, then stash the encrypted payloads in innocent files like LICENSE documents.

These loaders are a step up from the group’s earlier BeaverTail droppers. Intelligence gathered since early October reveals three distinct loader families, HexEval, XORIndex, and encrypted loaders, each tuned to bypass different controls. The malware rebuilds obfuscated BeaverTail directly in memory, then fetches the InvisibleFerret backdoor to maintain access.

The campaign’s infrastructure is equally slippery. It combines raw IP addresses on VPS providers with trusted platforms like Vercel, so traffic looks like everyday developer activity. Communication flows over HTTP, HTTPS, and WebSocket, and the URI paths read like normal work endpoints, for example, “/api/ipcheck,” “/process-log,” and “/apikey.” That naming buys them time, and it makes defenders sweat.

When defenses struggle

The reach and persistence should worry any organization that ships code. When security teams remove malicious packages, these state-sponsored actors quickly upload new variants under fresh names, meaning it’s a rinse and repeat submission, takedown, and re-upload cycle.

The financial motive is massive, a BBC report suggests North Korea-linked operators already stole over $2 billion in cryptocurrency during 2025 alone, and Contagious Interview is just one prong of a broader push against the crypto ecosystem. The malware hunts developers working with wallets, blockchain infrastructure, and Web3 apps, targeting systems that hold credentials, private keys, and other monetizable secrets.

Traditional defenses struggle here. Typosquatted packages targeting everyday dependencies turn routine actions, installing variants of Express, dotenv, or body-parser, into potential compromises. With cybersecurity experts documenting that BeaverTail persists across Windows, macOS, and Linux, a single infected developer workstation can hand attackers a foothold into corporate environments with serious money on the line. One bad install, and the dominoes start to fall.