Lazarus and Other Actors Adapt Tactics to Evade Software Supply-Chain Defenses
Summary
In a podcast discussion, researchers describe Lazarus Group and other actors using version sandwiching, reused blockchain addresses, package clusters, dynamic imports and split payloads in software supply-chain attacks.
Key points
- The speakers say Lazarus Group sometimes places a malicious package version between benign releases; scanning only the latest version may miss the malicious one.
- They describe Lazarus reusing Aptos, Tron and Binance BSC addresses with mutable memo fields, which may help researchers connect campaigns.
- Campaign-name strings embedded in payloads may help researchers link packages, endpoints and activity, though their meaning is uncertain.
- The speakers report that lower-sophistication actors are also targeting multiple ecosystems, including npm and PyPI, and publishing clusters where only some packages carry payloads.
- Dynamic imports can fetch dependencies from URLs at runtime, outside what package managers and some security controls can inspect, according to the discussion.
- Payloads may be split among files or packages and assembled through imports or dependencies, complicating analysis and takedowns.
Article Details
- Attack Vectors
- According to Paul McCarty, attackers publish benign package versions before and after a malicious release, then pin another package's dependency to the malicious version to evade scanners that inspect only the latest release.
- Attackers publish clusters of roughly two to ten packages, with only one or two carrying payloads and the others importing them. A previously benign package can take over payload delivery after another is removed.
- McCarty reports that Lazarus Group reuses Aptos, Tron, and Binance BSC blockchain addresses and mutable memo components as infrastructure for locating updated payloads.
- Attackers use VS Code tasks.json files to deliver platform-specific payloads and also compromise applications built on VS Code, including cursor and Windsurf.
- Runtime JavaScript imports retrieve dependencies directly from URLs rather than declaring them in package manifests, bypassing package-manager-focused inspection.
- Attackers split payload components across JavaScript or TypeScript files, and sometimes across multiple packages, assembling them through code imports or dependencies.
- McCarty reports that lower-sophistication groups use vibe coding to port similar payloads across npm, PyPI, and other package ecosystems.
- Defensive Notes
- Inspect historical package versions, not just the latest release, and verify the exact versions selected by dependent packages.
- Investigate related packages published close together, including apparently benign packages that import a malicious dependency.
- Use reused blockchain addresses and their mutable memo contents as hunting pivots; the hosts also suggest considering blockchain-related activity for alerting.
- Treat embedded tracking strings primarily as research pivots rather than standalone detection strings. Their internal meaning and relationship to individual operators remain uncertain.
- Extend malicious-package monitoring beyond npm to other ecosystems used by the organization; security improvements in one registry do not automatically apply elsewhere.
- Inspect source-level URL imports and the exact resources they retrieve. Distinguish malicious delivery domains from malicious resources hosted on otherwise legitimate CDNs.
- Analyze connected files and transitive dependencies together to identify payloads whose components are distributed across multiple artifacts.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationAttackers split payload components, including URL, protocol, path, and POST-related elements, across files or packages to hinder package analysis.T1059.007 · JavaScriptJavaScript code dynamically imports additional JavaScript from URLs at runtime, and separate JavaScript or TypeScript files call one another to assemble payloads.T1105 · Ingress Tool TransferMalicious packages retrieve additional payload code through runtime URL imports and dependencies; the article also describes tasks.json entries calling separate Windows, Linux, and Mac payloads.T1195.001 · Compromise Software Dependencies and Development ToolsAttackers publish malicious package versions and dependency clusters in npm, PyPI, and other registries so consuming software retrieves poisoned dependencies.
People
Jenn GileHost who discusses supply-chain research, cross-ecosystem malicious packages, and defensive implications of runtime imports and distributed payloads.Paul McCartyHost and malware researcher who reports observations from package analysis, including malicious-version sandwiching, reused blockchain infrastructure, and split payloads.
Threat Actors
GlasswormMcCarty describes Glassworm as adopting techniques used by Lazarus Group and as an earlier example of cross-ecosystem malicious-package activity.Lazarus GroupAttributed by the hosts to North Korea and described as using malicious-version sandwiching, reused blockchain infrastructure, package clusters, and embedded tracking strings.TeamPCPMcCarty identifies the group as adopting techniques previously used by Lazarus Group, in a discussion of VS Code tasks.json abuse and other supply-chain delivery methods.
Products
Cursor[00:27:12] Paul McCarty: They’re using, you know, the tasks.json VS Code to also compromise, um, cursor, and Windsurf, and other applications that are built on top of VS Code, so it makes sense. But same thing with, younpmare now being executed by low-sophistication crews using vibe coding tools to quickly port payloads across npm, PyPI, and other registries simultaneously. Package clusters, where only one or two packages in a publishedPyPIbeing executed by low-sophistication crews using vibe coding tools to quickly port payloads across npm, PyPI, and other registries simultaneously. Package clusters, where only one or two packages in a publishedVS Codemake one correction r- kind of related to the OpenVSX thing. When we were talking about, um, Microsoft VS Code marketplace, um, a couple of episodes ago, I said something which, basically I don’t have the quote inWindsurfPaul McCarty: They’re using, you know, the tasks.json VS Code to also compromise, um, cursor, and Windsurf, and other applications that are built on top of VS Code, so it makes sense. But same thing with, you