Aikido Security blog
Malware hiding in plain sight: Spying on North Korean Hackers (react-html2pdf.js npm package) · Mar 31, 2025
Just after 1pm we got notified by our malware detection tool that a new malicious package had been uploaded to NPM, directing us the the package react-html2pdf.js (since removed). ... This payload is not unfamiliar to us, we recognized it immediately as being from the state-sponsored North Korean hacking group, Lazarus.