cyber.hendryadrian.com
Threat Research · securityonline.info

Panther Details OtterCookie npm Campaign Attributed to DPRK Actors

· Original article ↗

Summary

Panther reports that obfuscated npm packages found April 6–9, 2026, delivered OtterCookie through benign-looking wrappers. The malware searches for secrets, scans files via a Vercel-hosted C2, and installs an SSH key backdoor on Linux.

Key points

  • Panther’s scanner flagged obfuscated npm packages that the investigation identified as OtterCookie variants.
  • The packages used benign-looking wrappers cloning big.js, with a malicious payload added as a dependency.
  • OtterCookie used custom base91-like string encoding with a different alphabet per function scope, hindering static string extraction.
  • The malware searched working directories for secrets such as Solana keypairs and fetched configuration from a Vercel-hosted C2 to scan the filesystem for specified file types.
  • On Linux, the malware added a fetched SSH public key to ~/.ssh/authorized_keys and attempted to open port 22 through the system firewall.
  • Panther attributed the activity with high confidence to DPRK / FAMOUS CHOLLIMA and reported infrastructure and tradecraft overlaps with Contagious Interview and Contagious Trader.

Article Details

Attack Vectors
  • Attackers published benign npm wrapper packages cloning big.js, with malicious payload packages such as bjs-lint-builder added as dependencies.
  • The OtterCookie payload used custom base91-like string encoding with per-function alphabet rotation to hinder static analysis.
  • OtterCookie searched working directories for secrets, including Solana keypairs, Rust configuration, and environment files, and used Vercel-hosted C2 configurations to scan filesystems recursively.
  • On Linux, OtterCookie appended a fetched SSH public key to ~/.ssh/authorized_keys and attempted to open port 22 through the system firewall.
Defensive Notes
  • Audit npm dependency chains for unexpected lint or builder packages, including dependencies nested beneath apparently benign wrappers.

MITRE ATT&CK

T1027 · Obfuscated Files or InformationOtterCookie used custom base91-like string encoding with a different alphabet for each function scope.T1083 · File and Directory DiscoveryThe malware used C2-provided configuration to recursively scan the filesystem for specified file extensions.T1098.004 · SSH Authorized KeysOn Linux, the malware established persistence by appending a fetched SSH public key to ~/.ssh/authorized_keys.T1195.001 · Compromise Software Dependencies and Development ToolsAttackers distributed malicious payload packages as dependencies of benign npm wrapper packages.T1552.001 · Credentials In FilesOtterCookie searched for secrets in files, including Solana keypairs, Rust configuration, and environment files.T1562.004 · Disable or Modify System FirewallThe malware attempted to open port 22 through the system firewall.

Threat Actors

Void DokkaebiPanther attributed the OtterCookie campaign to the North Korean threat group FAMOUS CHOLLIMA with high confidence.

Malware

OtterCookiePanther’s investigation uncovered obfuscated npm packages (April 6–9, 2026) that were variants of OtterCookie, an infostealer and backdoor attributed to North Korean state-sponsored actors.

Products

LinuxThe campaign installs an SSH public-key backdoor on Linux, has ties to DPRK / FAMOUS CHOLLIMA, and shares infrastructure and tradecraft with prior Contagious campaigns.npmPanther’s investigation uncovered obfuscated npm packages (April 6–9, 2026) that were variants of OtterCookie, an infostealer and backdoor attributed to North Korean state-sponsored actors.

Related Articles