BeaverTail / InvisibleFerret multi-stage npm campaign (in 2025 Mid-Year Threat Report)

Socket.dev blog

In one campaign linked to North Korean threat actors, the initial package delivered a loader called “BeaverTail” that stole browser data and Solana wallet credentials. It then fetched and deployed a more advanced backdoor named “InvisibleFerret”.