Software developers (npm ecosystem) Organizations hiring remote developers

Date (as written): 29/04/2026
Year: 2026
Country: Global
Actors (as written): Famous Chollima (linked to Contagious Interview)
Actor pages: Famous Chollima
Tags (as written): Attack: Malware; Target Class: Information/Communication; Attack Class: Cyber Espionage Cyber Crime; Initial Access: T1195.001 - Compromise Software Dependencies and Development Tools

Source entries (2)

Hackmageddon cyber attacks timelines (Paolo Passeri)

Software developers (npm ecosystem) Organizations hiring remote developers · 29/04/2026

Researchers at ReversingLabs discover the PromptMink campaign, and link it to North Korean Famous Chollima for a new wave using AI-generated npm malware disguised as a utility SDK, combined with fake firms and RATs to steal secrets from developer environments. [Date Occurred: Since October 2025; Date Discovered: Since October 2025]

https://www.hackmageddon.com/2026/05/08/16-30-april-2026-cyber-attacks-timeline/

https://docs.google.com/spreadsheets/d/e/2PACX-1vTbUD4I3wQ1E1jETF6dbBelX6hJcQlgbij6JChX-YeotprThdKtAQeN9ejPXdVBeiQDhudcNBWK5HlY/pub?gid=1060075184&single=true&output=csv

https://thehackernews.com/2026/04/new-wave-of-dprk-attacks-uses-ai.html

ReversingLabs blog

PromptMink / Famous Chollima campaign (mentioned in Forrester landscape post) · 2026-05-28T18:00:00.000Z

That incident is part of a broader campaign tied to the North Korean-linked group Famous Chollima, which is leveraging AI-generated code and a layered package strategy to evade detection and more effectively deceive automated coding assistants than human developers.

https://www.reversinglabs.com/blog/forrester-agentic-development-security-landscape

Suggest a correction on GitHub