Socket.dev blog
Lazarus npm packages (cited in ENISA 2025 Threat Landscape) · 2025-10-16T21:22:16.651Z
North Korea’s Lazarus Group remains active in 2025. ENISA references Socket’s earlier reports, North Korean APT Lazarus Targets Developers With Malicious npm Package and Lazarus Strikes npm Again With a New Wave of Malicious Packages , which document npm packages impersonating legitimate libraries to compromise developer systems.