North Korean Hackers Target Crypto Devs Through Open-Source Software Hub
North Korean state-sponsored hackers have infiltrated the npm registry, a critical repository for JavaScript developers, in a campaign dubbed "Contagious Interview." Over 300 malicious code packages were uploaded, masquerading as harmless Web3 and crypto development tools. Once installed, the malware steals credentials, browser data, and cryptocurrency wallet keys.
The attackers posed as tech recruiters, specifically targeting blockchain and Web3 developers. This supply-chain attack highlights npm's vulnerability as a backbone of modern web infrastructure—and the growing sophistication of state-backed cyber threats.