Researchers Link DPRK Campaigns to AI-Assisted npm Malware and Fake Job Lures
Summary
Researchers attribute the PromptMink npm campaign to North Korean actor Famous Chollima; its layered dependencies are designed to steal credentials and crypto-wallet data. Related campaigns use fake job interviews, malicious packages and RATs to target developers.
Key points
- ReversingLabs named PromptMink and linked it to North Korean actor Famous Chollima, also known as Shifty Corsair.
- The campaign uses benign first-layer npm packages that pull in malicious dependencies, along with typosquatting and other techniques to evade detection.
- The article says a February 2026 commit co-authored by Claude Opus introduced a malicious dependency to an autonomous trading agent, potentially exposing users’ crypto wallets through leaked credentials.
- Early PromptMink variants searched for .env and .json files and staged data for exfiltration; later variants targeted Windows, Linux and macOS and could drop SSH backdoors.
- A separate package, express-session-js, is believed to be linked to Contagious Interview and reportedly delivers a RAT with capabilities including credential theft, keylogging and remote input control.
- In the graphalgo campaign, fake companies and job-interview coding tasks lure developers into projects whose dependencies deliver RATs; malicious dependencies have also been hosted as GitHub release artifacts.
Article Details
- Event Type
- Malicious software supply-chain campaigns using trojanized npm and PyPI packages, fake companies, and job-interview lures to deploy credential stealers and remote access trojans.
- Impact
- Compromised developer systems and projects were exposed to theft of cryptocurrency-wallet credentials, browser credentials, AWS keys, GitHub tokens, source code, and other secrets. Reported payload capabilities also include keylogging, screenshot capture, clipboard monitoring, and remote control of infected hosts.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | csec-c2-server[.]onrender[.]com | External server identified as the destination for stolen AWS keys, GitHub tokens, and .npmrc files. |
| DOMAIN | ipfs-url-validator[.]vercel[.]app | Specific Vercel-hosted URL identified as an exfiltration destination for early versions of the malware. |
| IPV4 | 216[.]126[.]237[.]71 | IP address the RAT delivered through the express-session-js package reportedly connects to for command and control. |
MITRE ATT&CK
T1056.001 · KeyloggingThe reported RAT capabilities include keylogging.T1059.007 · JavaScriptEarly payloads were JavaScript-based stealers delivered through malicious Node.js packages.T1083 · File and Directory DiscoveryThe malware recursively scanned working directories and RATs were reported to enumerate files and directories.T1105 · Ingress Tool TransferA malicious package acted as a dropper that fetched a second-stage payload.T1113 · Screen CaptureThe reported RAT capabilities include screenshot capture.T1115 · Clipboard DataThe reported RAT capabilities include clipboard monitoring.T1195.002 · Compromise Software Supply ChainMalicious npm and PyPI packages were introduced as dependencies to compromise software supply chains.T1555.003 · Credentials from Web BrowsersThe reported RAT capabilities include browser credential theft.
People
Curt BuchananBlueVoyant researcher quoted discussing the campaigns' evolution and use of Vercel-hosted C2 infrastructure.Karlo ZankiReversingLabs security researcher quoted describing the fake companies and their role in lending credibility to fraudulent job offers.Vladimir PezoReversingLabs researcher quoted describing the tainted package and its introduction into an autonomous trading agent.
Threat Actors
BlueNoroffIdentified by Hunt.io as the Lazarus Group sub-cluster linked to the supply-chain attack.Lazarus GroupHunt.io attributed a supply-chain attack to a sub-cluster of Lazarus Group.Shifty CorsairIdentified in the article as another name for Famous Chollima, which is linked to the reported malicious campaigns.UNC1069A North Korean state-sponsored threat cluster reportedly linked to the compromise of the axios npm package.Void DokkaebiReversingLabs attributes the PromptMink activity and related campaigns to this North Korean threat actor.
Malware
NukeSped RATIn its report detailing the supply chain compromise, Hunt.io tied the attack to a Lazarus Group sub-cluster known as BlueNoroff, citing infrastructure overlaps and the RAT’s similarities with NukeSped.OtterCookieRelated operations (OtterCookie, Contagious Trader, graphalgo) deploy RATs, steal AWS/GitHub keys and lure developers via fake companies and job interview scenarios.
Vendors
Products
Claude OpusAttackers used AI-generated code (Anthropic’s Claude Opus) and a two-layer dependency strategy where benign first-layer packages pull malicious second-layer packages.GitHubThe campaign abuses transitive dependencies, typosquatting, GitHub release artifacts and Vercel-hosted C2 to evade detection and persist.npmResearchers discovered malicious code embedded in the npm package “@validate-sdk/v2” that acts as a credential and crypto-wallet stealer when introduced as a dependency to other projects.PyPIIn the intervening months, the campaign has undergone various transformations, even targeting the Python Package Index (PyPI) by pushing a malicious package (“scraper-npm”) with the same functionality in February 2026.VercelThe campaign abuses transitive dependencies, typosquatting, GitHub release artifacts and Vercel-hosted C2 to evade detection and persist.
Countries
Industries
Cryptocurrencythat creates a social on-chain identity on the Solana blockchain using the Tapestry Protocol, trades cryptocurrency via Bankr, as well as interacts with other agents on Moltbook.Software developmentThe package in question is “@validate-sdk/v2,” which is listed on npm as a utility software development kit (SDK) for hashing, validation, encoding/decoding, and secure random generation.Web3North Korean threat actors’ continued targeting of the open-source ecosystem to target developers in the Web3 space.