North Korea’s New Cyber Tactic: Weaponizing the Open-Source Supply Chain
16.10.2025 15:00 2 min. read Alexander Zdravkov
A new report by U.S. cybersecurity firm Socket has revealed that North Korean hackers have infiltrated one of the internet’s most vital open-source ecosystems, turning it into a weapon for cyber theft.
The attackers uploaded over 300 malicious code packages to npm, the world’s largest JavaScript software library used by millions of developers globally.
These corrupted packages appeared legitimate but secretly installed malware capable of stealing login credentials, browser data, and crypto wallet keys once downloaded. Socket traced the campaign – dubbed “Contagious Interview” – to North Korean state-sponsored groups that have long impersonated tech recruiters targeting developers in blockchain and Web3 sectors.
The implications are severe. Npm underpins much of today’s digital infrastructure, meaning a compromise can cascade across thousands of apps through standard software updates. Experts have repeatedly warned that supply-chain attacks like this are among the hardest to detect, as they exploit the trust developers place in widely used dependencies.
Socket’s researchers identified the malicious activity through fake package names mimicking popular libraries such as express, dotenv, and hardhat, along with code linked to known North Korean malware families like BeaverTail and InvisibleFerret. The malware operated entirely in memory, making it difficult to trace. By the time the attack was uncovered, the infected packages had already been downloaded roughly 50,000 times.
The hackers also relied on fake LinkedIn recruiter profiles – a familiar tactic in Pyongyang’s cyber playbook – to distribute their malware and gain access to systems containing crypto wallets or company credentials.
Although GitHub, which owns npm, has removed most of the identified threats and tightened account verification, cybersecurity analysts warn that new malicious uploads continue to appear. The open nature of npm, while fostering innovation, also creates opportunities for exploitation.
For developers, this incident is a stark reminder that every dependency download carries risk. Experts recommend scanning packages before installation, implementing automated monitoring tools, and assuming that any external code could potentially execute harmful scripts. In an ecosystem built on openness, vigilance has become the first line of defense.
-
1
North Korean Hackers Steal Over $2 Billion in Crypto in 2025, Marking Record Year of Cyber Theft
07.10.2025 15:10 2 min. read -
2
Chinese Investors Struggle to Recover Bitcoin After Massive Scam
13.10.2025 22:00 2 min. read -
3
Another Crypto Data Leak Underscores Industry’s Security Gaps
11.10.2025 17:00 2 min. read -
4
Criminal Crypto Wallets Hold Nearly $15 Billion as Governments Target Seized Assets for Reserves
09.10.2025 20:00 1 min. read -
5
North Korea’s New Cyber Tactic: Weaponizing the Open-Source Supply Chain
16.10.2025 15:00 2 min. read
Google Uncovers North Korea’s Onchain Hacking Experiment
A new cyber tactic from North Korea is blurring the line between blockchain innovation and weaponization.
FIFA Faces Legal Heat in Switzerland Over NFT Competitions
Switzerland’s gambling watchdog, GESPA, has lodged a criminal complaint regarding FIFA’s World Cup-themed NFT platform, citing potential breaches of national gambling laws.
Chinese Investors Struggle to Recover Bitcoin After Massive Scam
Hundreds of thousands of Chinese investors who lost money in a $6 billion Bitcoin Ponzi scheme may spend years navigating legal hurdles to recover their funds.
Another Crypto Data Leak Underscores Industry’s Security Gaps
Crypto platform Shuffle has launched an internal investigation after a data leak traced to its messaging partner, Fast Track, compromised user information.
-
1
North Korean Hackers Steal Over $2 Billion in Crypto in 2025, Marking Record Year of Cyber Theft
07.10.2025 15:10 2 min. read -
2
Chinese Investors Struggle to Recover Bitcoin After Massive Scam
13.10.2025 22:00 2 min. read -
3
Another Crypto Data Leak Underscores Industry’s Security Gaps
11.10.2025 17:00 2 min. read -
4
Criminal Crypto Wallets Hold Nearly $15 Billion as Governments Target Seized Assets for Reserves
09.10.2025 20:00 1 min. read -
5
North Korea’s New Cyber Tactic: Weaponizing the Open-Source Supply Chain
16.10.2025 15:00 2 min. read
In a cybersecurity twist that sounds more like espionage fiction than reality, Kraken recently intercepted an attempted infiltration by a North Korean hacker—disguised as a job seeker.
Recent developments suggest that the Lazarus Group, a notorious state-sponsored hacking entity, may be behind the $305 million breach of Japanese crypto exchange DMM Bitcoin.
North Korean hackers could potentially shift their focus to U.S.-based Bitcoin exchange-traded funds (ETFs), according to security experts.
North Korean hackers, under the BlueNoroff subgroup of the Lazarus Group, have escalated their cyberattacks, shifting from social media manipulation to targeted phishing emails in their 'Hidden Risk' campaign.
North Korea-linked hacking groups have looted more than $2 billion in cryptocurrency so far in 2025, according to a new report from blockchain analytics firm Elliptic.
Northern Data, a company with stakes in both cryptocurrency and AI infrastructure, is currently facing a lawsuit filed in California by former executives Joshua Porter and Gulsen Kama.
Norway’s central bank, Norges Bank, has backed the EU’s Markets in Crypto-Assets Regulation (MiCA) as it considers a central bank digital currency (CBDC).
Norway may hit the pause button on cryptocurrency mining later this year. The government announced Friday it will study whether to impose a provisional ban on mining data centers, arguing that energy and grid capacity should be reserved for more pressing needs.
Next year, Norges Bank, Norway's central bank, will decide on the potential establishment of its own central bank digital currency (CBDC).
Norges Bank Investment Management (NBIM), the operator of Norway’s $1.7 trillion Government Pension Fund Global and the world’s largest sovereign wealth fund, has sharply increased its exposure to Bitcoin-linked assets, according to analysis of recent regulatory filings.
Norway’s sovereign wealth fund, NBIM, has increased its Bitcoin holdings to approximately $149.48 million, with a total of 2,446 BTC.
Norway’s giant sovereign wealth fund - worth about $1.5 trillion — now holds more Bitcoin exposure than ever before, though not by directly buying the cryptocurrency.
Oslo-based seabed-mining firm Green Minerals is shifting its treasury reserves from kroner and dollars into bitcoin, calling the move a hedge against inflation and geopolitical risk.
Notcoin, one of the breakout names in Web3 gaming last year, says the days of mindless "tap-to-earn" mechanics are likely over.
Brazilian digital bank Nubank has announced the immediate suspension of trading for its native cryptocurrency, Nucoin.
Nvidia and Apple are rumored to be interested in joining OpenAI's next funding round, which could potentially raise the company's valuation to over $100 billion.
Nvidia CEO Jensen Huang has recently sold $49 million worth of NVDA shares, continuing a significant divestment trend.
Nvidia's CEO Jensen Huang has been rapidly offloading his shares in the company amid recent stock fluctuations.
During London Tech Week, Nvidia CEO Jensen Huang highlighted a critical gap in the UK’s artificial intelligence ambitions: while the country is home to exceptional talent, it lacks the computing backbone necessary to lead globally.
AI-related cryptocurrencies saw significant growth last week, while Nvidia shares lost over $400 million in market capitalization.