North Korean Hackers Upload 300 Malicious Code Packages Targeting Blockchain Firms

Socket’s researchers traced the campaign through a cluster of look-alike package names—misspelled versions of popular libraries such as express, dotenv, and hardhat—and through code patterns linked to previously identified North Korean malware families known as BeaverTail and InvisibleFerret. The attackers used encrypted “loader” scripts that decrypted and executed hidden payloads directly in memory, leaving few traces on disk.

The firm said roughly 50,000 downloads of the malicious packages occurred before many were removed, though some remain online. The hackers also used fake LinkedIn recruiter accounts, a tactic consistent with previous DPRK cyber-espionage campaigns documented by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and previously reported in Decrypt. The ultimate targets, investigators believe, were machines holding access credentials and digital wallets.

While Socket’s findings line up with reports from other security groups and government agencies linking North Korea to cryptocy thefts totaling billions of dollars, independent verification of every detail—such as the exact number of compromised packages—remains pending. Still, the technical evidence and patterns described are consistent with prior incidents attributed to Pyongyang.

Npm’s owner, GitHub, has said it removes malicious packages when discovered and is improving account-verification requirements. But the pattern, researchers say, is whack-a-mole: take down one set of malicious packages, and hundreds more soon take their place.