| 2023-08-12T22:25:00+00:00 | Sophisticated, Highly-Targeted Attacks Continue to Plague npm (campaign with behaviors similar to June North Korean campaign) | | North Korean state actors (June campaign) |
| 4 November 2023 | “Crypto-Themed npm Packages Found Delivering Stealthy Malware,” Phylum Research Team | | |
| 2023-06-23T22:48:00+00:00 | Phylum Discovers Sophisticated Ongoing Attack on NPM (later update: attributed to North Korea) | | North Korean nation-state actors |
| 2023-07-25T20:55:00+00:00 | npm package-pair attack attributed to Jade Sleet (in Q2 2023 Evolution of Software Supply Chain Security Report) | | Jade Sleet; TraderTraitor |
| 2023-10-17T20:52:00+00:00 | North Korean state-affiliated npm and PyPI attacks (in Q3 2023 Evolution of Software Supply Chain Security Report) | | North Korean state-affiliated actors |
| 2024-08-29T19:31:00+00:00 | North Korea Still Attacking Developers via npm | | groups aligned with North Korean objectives |
| (published February 28, 2024) | Lazarus malicious npm package containing Comebacker (case reported by Phylum) | | Lazarus (as considered by JPCERT/CC) |
| 2024-01-22T20:47:00+00:00 | Lazarus npm social engineering campaigns 2023 (in Q4 2023 Evolution of Software Supply Chain Security Report) | | Lazarus group |
| 2024-04-15T20:27:00+00:00 | npm code-profiler package / fake job social engineering campaign (in Q1 2024 Evolution of Software Supply Chain Security Report) | | North Korean state-sponsored efforts |
| 2024-04-24T16:43:00+00:00 | Nation-State Threat Actors Renew Publications to npm | | North Korea |
| 2024-07-08T18:48:00+00:00 | New Tactics from a Familiar Threat (call-blockflow npm package) | | North Korean threat actors |
| 2024-07-31T20:24:00+00:00 | nebourhood npm packages (react-dom-production-script, hardhat-daemon) (in Q2 2024 Evolution of Software Supply Chain Security Report) | | North Korean state actors |
| 2024-10-31T20:07:44+00:00 | North Korean APT npm campaigns (in Q3 2024 Evolution of Software Supply Chain Security Report) | | North Korean Advanced Persistent Threat (APT) groups |
| 2024-11-20T20:03:41+00:00 | North Korean open-source ecosystem attacks (in 2025 Software Supply Chain Security Trends & Predictions) | | North Korea |
| 2025-04-09T15:45:00+00:00 | Resurgent North Korean Malware Campaign in npm | | North Korean attackers |
| 2025-07-31T15:33:36+00:00 | North Korean Crypto Stealing Campaign Rears Its Head Again | | North Korean |
| 2025-12-11T16:33:55+00:00 | Contagious Interview (in Threat Research Year In Review - 2025) | | Famous Chollima |
| 2026-07-01T17:53:56.469Z | PolinRider: North Korea-Linked Supply Chain Campaign Expands Across Open Source Ecosystems | | |
| 2026-08-11 | Shattering the Dream - When a Job Offer Becomes a Zero-Day Attack | | |
| August 03, 2026 | STARDUST CHOLLIMA malicious npm dependency injected into at least 131 Mastra AI framework packages (June 2026) | | STARDUST CHOLLIMA |
| 2026-07-15T20:23:28+00:00 | PolinRider campaign (in Cyber Risk Intelligence Brief July 2026) | | North Korea-linked PolinRider |
| 2026-08-26T19:22:32+00:00 | DPRK-linked Rust crate typosquats (proc-macro1) (in CISO Risk Intel Brief Aug 26 2026) | | DPRK |