North Korea Hacks npm in Supply Chain Attack on Devs

Cybersecurity researchers have identified a new wave of North Korea hacks npm as part of an ongoing supply chain attack targeting software developers. The campaign, known as Contagious Interview, involves 35 malicious JavaScript packages published through 24 separate npm accounts. Security firm Socket reported that these packages have already been downloaded more than 4,000 times.

The attackers appear to be leveraging npm, a popular package manager for JavaScript, to distribute harmful code and potentially compromise developer environments. The scope of the campaign indicates a coordinated effort to infiltrate software supply chains by exploiting widely used open-source tools.

Researchers linked this activity to North Korea hacks npm by analyzing the tactics and infrastructure associated with the uploads. The full list of impacted packages includes various modules that mimic legitimate software, making it more difficult to detect the threat.

For a deeper look into this developing threat, read the full report at:
https://thehackernews.com/2025/06/north-korea-linked-supply-chain-attack.html