North Korea Floods npm Registry with Malware

North Korean threat actors escalated their software supply chain attacks by uploading 67 new malicious packages to the npm Registry as part of the ongoing Contagious Interview campaign. The malware targets open-source JavaScript developers with malware loaders.

See Also: AI vs. AI: Leveling the Defense Playing Field

The latest wave of attacks marks an expansion of the campaign, which began in April 2025 and intensified in June. Researchers at Socket identified 28 of the newly published npm packages using a previously undocumented malware loader named XORIndex, while 39 others used the older HexEval Loader. Together, these 67 packages were downloaded more than 17,000 times, with 27 still live on the npm registry at the time of discovery.

The free npm Registry is a leading JavaScript code sharing platform, and with more than 2 million packages. Node package manager for JavaScript is maintained by npm Inc., a subsidiary of GitHub.

Socket researchers said that the campaign targeting the registry builds on prior activity. In June, the same North Korean threat actors infiltrated the npm ecosystem with 35 malicious packages that deployed information stealers and backdoors on developer systems. The current campaign reflects an ongoing refinement of tools and persistence in targeting the open-source supply chain.

XORIndex introduces enhanced obfuscation methods, including XOR-encoded strings and index-based obfuscation, making detection more difficult. Once installed, the loader collects host telemetry, such as the system hostname, username, IP address, OS type and geolocation and transmits this data to hardcoded command-and-control servers hosted on legitimate infrastructure platforms like Vercel.

The malware then executes JavaScript payloads received from the C2, triggering a second-stage downloader known as BeaverTail. This component searches for and archives sensitive information including browser extension data and cryptocurrency wallet credentials. It targets nearly 50 wallet paths and numerous browser profiles, extracting data and exfiltrating it to hardcoded IP addresses using HTTP POST requests.

The final payload, dubbed InvisibleFerret, functions as a third-stage backdoor. After data is uploaded, BeaverTail attempts to download and execute additional malicious components from the same C2 server, ensuring persistent access and expanded capabilities across compromised systems.

Socket researchers documented the rapid evolution of XORIndex across three developmental stages. The initial version, postcss-preloader, offered basic remote code execution with no obfuscation or telemetry collection. A second prototype, js-log-print, introduced partial reconnaissance features, though it was flawed. The third variant, dev-filterjs, implemented string obfuscation using ASCII buffers and transmitted accurate host data, paving the way for the more advanced current version of XORIndex.

Threat actors relied on familiar tactics to maintain campaign momentum. Many packages followed consistent naming conventions such as vite-*, *-log* and reused infrastructure from earlier campaigns. The adversaries continued to rotate email addresses and npm account aliases to evade detection and rapidly replace removed packages.

Researchers said that the Contagious Interview campaign is designed to be persistent, evasive and modular. Its reliance on memory-only execution, JavaScript-based payload delivery and legitimate cloud infrastructure reduces visibility and complicates incident response. Analysts expect future variants to introduce new loader types, evasion techniques and additional malware families while continuing to exploit open-source ecosystems.