North Korean-Linked Hackers Distribute 1,700 Malicious Packages Across Multiple Package Repositories

Apr 8
2 min read

North Korean-linked threat actor "Contagious Interview" has distributed over 1,700 malicious packages across npm, PyPI, Go, Rust, and Packagist ecosystems since January 2025
Malicious code is hidden within legitimate-looking functions and only executes at runtime, not during installation, making detection harder
Packages function as malware loaders delivering second-stage payloads with infostealer, RAT, and post-compromise capabilities including keylogging and remote access
Campaign attributed to UNC1069, which overlaps with BlueNoroff, Sapphire Sleet, and Stardust Chollima
North Korean actors are using social engineering via Telegram, LinkedIn, and Slack to distribute fake video conferencing links that deliver ClickFix-style malware

Background

The Contagious Interview campaign represents a sophisticated, well-resourced supply chain threat targeting developer environments across multiple programming ecosystems. This coordinated effort marks a significant escalation in North Korean threat actor capabilities, demonstrating their ability to systematically infiltrate open-source platforms as initial access points for espionage and financial gain.

Campaign Scope and Package Distribution

Socket security researchers identified malicious packages impersonating legitimate developer tools across five major ecosystems. The npm repository contained dev-log-core, logger-base, logkitx, pino-debugger, debug-fmt, and debug-glitz. PyPI hosted logutilkit, apachelicense, fluxhttp, and license-utils-kit. Go ecosystem saw github.com/golangorg/formstash and github.com/aokisasakidev/mit-license-pkg. Rust received logtrace, while Packagist included golangorg/logkit. This cross-ecosystem approach demonstrates the threat actor's determination to reach developers regardless of their preferred programming language.

Deceptive Execution Methods

The malware's sophistication lies in its delayed activation strategy. Rather than triggering during package installation when security tools actively monitor behavior, the malicious code embeds itself within seemingly legitimate functions that align with each package's advertised purpose. In logtrace, for example, the payload hides within Logger::trace(i32), a method developers would naturally call during normal operations without suspicion.

Payload Capabilities

The second-stage payloads deliver varying levels of functionality depending on the target platform. All versions include infostealer and RAT capabilities focused on harvesting data from web browsers, password managers, and cryptocurrency wallets. The Windows variant delivered via license-utils-kit includes more extensive post-compromise functionality, allowing attackers to execute shell commands, log keystrokes, steal browser credentials, upload files, terminate web browsers, deploy AnyDesk for remote access, and download additional modules.

Related North Korean Activity

Beyond the Contagious Interview campaign, North Korean actors have demonstrated broader supply chain attack capabilities. UNC1069 compromised the popular Axios npm package maintainer account through tailored social engineering, distributing an implant called WAVESHAPER.V2. The same group operates multi-week social engineering campaigns across Telegram, LinkedIn, and Slack, impersonating legitimate contacts or services like Microsoft Teams and Zoom. Security Alliance blocked 164 UNC1069-linked domains between February and April 2026, with attackers deliberately delaying post-compromise action to avoid detection and extend their operational window.

Evolving Threat Landscape

Microsoft's threat intelligence team has observed consistent evolution in North Korean financially motivated actor toolsets and infrastructure, with clear continuity in operational behavior and intent. The use of domains masquerading as U.S.-based financial institutions and video conferencing applications indicates these groups are adapting their social engineering tactics while maintaining their core objectives of theft and long-term system compromise.

Sources

https://thehackernews.com/2026/04/n-korean-hackers-spread-1700-malicious.html
https://www.socdefenders.ai/item/dadc9458-66a4-42f1-bdc4-c0e42fe18cab
https://x.com/TheCyberSecHub/status/2041793312412332287
https://x.com/TheHackersNews/status/2041785458129301791
https://news.backbox.org/2026/04/08/n-korean-hackers-spread-1700-malicious-packages-across-npm-pypi-go-rust/