Multilateral Sanctions Monitoring Team (MSMT) report, 22 Oct 2025
Malicious NPM packages for skill assessment tests (e.g. “myetherpackage,” “cryptooooo,” “libcrypt-test”)
(MSMT/2025/2, report p. 32) “According to an MSMT Participating State and industry reporting, DPRK actors associated with CryptoCore uploaded dozens of packages to NPM, almost certainly for use in spear phishing campaigns. Some of the NPM packages had cryptocurrency-related names, such as “myetherpackage,” “cryptooooo,” and “libcrypt-test.””