Phylum Discovers Sophisticated Ongoing Attack on NPM (later update: attributed to North Korea) · 2023-06-23T22:48:00+00:00
Jul 22, 2023 Update : This attack has now been attributed to North Korean nation-state actors.
June’s Sophisticated npm Attack Attributed to North Korea · 2023-07-22T22:44:00+00:00
In June 2023, Phylum was the first to unearth a series of suspicious npm publications belonging to what appeared to be a highly targeted attack. The identified packages, published in pairs, required installation in a specific sequence, subsequently retrieving a token that facilitated the download of a final malicious payload from a remote server. A recent security alert from GitHub publicly attributes this cyber-attack—which they were investigating independently—to threat actors with strong ties to North Korean objectives.