Lazarus malicious npm package containing Comebacker (case reported by Phylum) · (published February 28, 2024)
In this case, a npm package contains Comebacker, and thus the attack is considered to have been conducted by Lazarus as well.
Multiple organizations · 20/02/2024
Researchers from Phylum discover a set of fake npm packages on the Node.js repository linked with North Korean state-sponsored actors. [Date Occurred: Since at least 04/02/2024; Date Discovered: 05/02/2024]
Fake Developer Jobs Laced With Malware · 2024-02-20T17:11:00+00:00
The Phylum research team also received word from Palo Alto Network’s Unit 42 that the malicious, obfuscated JavaScript on which this blog post is based coincided with BeaverTail from their own independent research into an ongoing North Korean job-seeking campaign against software developers. ... Based on independent, corroborating research, it now appears that this is the work of state-sponsored North Korean activity.