“Crypto-Themed npm Packages Found Delivering Stealthy Malware,” Phylum Research Team · 4 November 2023
Annex 99 (Select reports of DPRK cyber actors targeting the cryptocurrency industry), report 6: “Crypto-Themed npm Packages Found Delivering Stealthy Malware,” Phylum Research Team, 4 November 2023. Summary: On 30 October 2023 Phylum identified an unusual publication to npm called “puma-com.” ... Phylum identified four additional packages belonging to this campaign.
“Update to November’s Crypto-Themed npm Attack,” Phylum Research Team · 5 January 2023 [as printed]
Annex 99 (Select reports of DPRK cyber actors targeting the cryptocurrency industry), report 14: “Update to November’s Crypto-Themed npm Attack,” Phylum Research Team, 5 January 2023 [as printed]. Summary: Updating on Phylum’s 4 November 2023 report (see above) regarding a collection of npm packages involved in a complex attack chain, Phylum has identified nearly two dozen additional packages belonging to this still active campaign. Phylum further referenced the QiAnXin Threat Intelligence Center report (see above), “conclusively linking it to a North Korean APT.”
Update to November’s Crypto-Themed npm Attack · 2024-01-05T21:36:00+00:00
Since that initial report, we have identified nearly two dozen additional packages belonging to this still active campaign. Additionally, the QiAnXin Threat Intelligence Center released a detailed analysis of the binary involved in this campaign, conclusively linking it to a North Korean APT.