North Korean hackers uploaded over 300 malicious code packages targeting Blockchain companies to the mainstream software library npm.

PANews reported on October 16 that the American cybersecurity company Socket stated in a report that a North Korean hacker organization uploaded over 300 malicious code packages to the mainstream software library npm, disguising them as misspelled versions of popular libraries (such as express and hardhat), embedding malware that can steal passwords and encryption Wallet Secret Keys. This operation has been named “Infectious Interview,” where hackers impersonate technical recruiters targeting Blockchain and Web3 developers. Some of the malicious packages remain online after approximately 50,000 downloads. Researchers traced the code patterns back to the North Korean hacker organization, whose loader scripts use memory decryption techniques to avoid leaving traces. Although GitHub has strengthened verification and delisted some malicious packages, Supply Chain security threats continue to spread. Security experts recommend that development teams treat each dependency installation as a potential code execution and scan for verification before merging into the project.