| 2023-07-18T14:43:24+00:00 | Security alert: social engineering campaign targets technology industry employees | | Jade Sleet; TraderTraitor |
| 2023-12-19T03:09:44.762Z | 3CX supply chain attack (mentioned in "Strengthening Crypto Supply Chain Security Is a Necessity, Not an Option") | | |
| 2024-01-03T18:09:34.148Z | Orbit Bridge Hackers Drain $81 Million in Crypto Assets | | state-sponsored North Korean hackers (suggested by Taylor Monahan) |
| 2025-02 | Bybit | United Arab Emirates | Lazarus |
| 2025-03-10T22:59:28.808Z | Lazarus Strikes npm Again with New Wave of Malicious Packages | | |
| 2025-07-14T21:43:41.794Z | Contagious Interview Campaign Escalates With 67 Malicious npm Packages and New Malware Loader | | |
| 2025-04-04T12:25:43.627Z | Lazarus Expands Malicious npm Campaign: 11 New Packages Add Malware Loaders and Bitbucket Payloads | | |
| 2025-10-10T17:13:22.383Z | North Korea’s Contagious Interview Campaign Escalates: 338 Malicious npm Packages, 50,000 Downloads | | |
| 2025-11-26T20:13:53.254Z | Inside the GitHub Infrastructure Powering North Korea’s Contagious Interview npm Attacks | | |
| 2025-01-29T22:47:16.420Z | North Korean APT Lazarus Targets Developers with Malicious npm Package | | |
| 2025-06-25T01:10:19.162Z | Another Wave: North Korean Contagious Interview Campaign Drops 35 New Malicious npm Packages | | |
| 2025-05-14T16:44:07.782Z | BeaverTail / InvisibleFerret multi-stage npm campaign (in 2025 Mid-Year Threat Report) | | North Korean threat actors |
| 2025-06-12T13:47:04.870Z | Contagious Interview campaign (in 2025 Blockchain and Cryptocurrency Threat Report) | | North Korea |
| 2025-09-17T17:07:11.749Z | Identifying and Preventing Fraudulent Engineering Candidates: An Investigation into 80 Confirmed Cases | | suspected North Korean operators |
| 2025-10-16T21:22:16.651Z | Lazarus npm packages (cited in ENISA 2025 Threat Landscape) | | Lazarus Group |
| 2026-03 | Axios | | Bluenoroff |
| 2026-07-01T17:53:56.469Z | PolinRider: North Korea-Linked Supply Chain Campaign Expands Across Open Source Ecosystems | | |
| 2026-02-27T14:18:40.511Z | StegaBin: 26 Malicious npm Packages Use Pastebin Steganography to Deploy Multi-Stage Credential Stealer | | |
| 03/04/2026 | Node.js ecosystem maintainers (Socket CEO, Platformatic CTO, Dotenv creator, Node.js Security WG, and others) | Global | UNC1069 (North Korean state-linked) |
| 2026-04-07T21:36:45.870Z | North Korea’s Contagious Interview Campaign Spreads Across 5 Ecosystems, Delivering Staged RAT Payloads | | |
| 2026-05-31T18:41:00.591Z | Famous Chollima Targets PHP Developers Through Compromised Packagist Package | | |
| 2026-09-17T15:33:22.860Z | PolinRider Spreads Through Compromised GitHub Accounts and Packagist | | |
| 2026-05-20T15:25:11.368Z | DPRK-aligned social engineering campaign against Node.js maintainers (mentioned in Series C announcement) | | DPRK-aligned attackers |
| 2026-08-21T17:54:18.276Z | Malicious code in development version of Laravel package linked to Famous Chollima (mentioned in PHP and Composer Support post) | | Famous Chollima |