Sonatype
Lazarus Group packages in npm and PyPI (in Q2 2025 Open Source Malware Index) · 2025-07-08T10:00:00.000Z
Sonatype attributed 107 malicious packages to the Lazarus Group, an APT linked to the North Korean government. These packages accounted for over 30,000 known downloads. ... Over the past three months, Sonatype detected and logged 107 malicious components associated with Lazarus across both npm and PyPI, using deceptive names that mimic configuration or plugin utilities, such as http-parse, node-orm-mongoose, vite-meta-plugin, and mainx.