New Wave of DPRK Attacks Uses AI-Inserted npm Malware, Fake Firms, and RATs

Researchers discovered a major malware campaign targeting developers through compromised npm packages, attributed to North Korean threat actor Famous Chollima using AI-generated code.

• •Malicious npm packages like "@validate-sdk/v2" and "@solana-launchpad/sdk" steal cryptocurrency wallet credentials and environment secrets from developer systems
• •Two-layer package strategy places malicious code in secondary dependencies to evade detection, with benign packages importing nefarious second-layer packages
• •Malware evolved from obfuscated JavaScript to Rust-compiled payloads capable of SSH backdoor installation and exfiltrating entire projects
• •Graphalgo campaign uses fake companies with fraudulent job interviews and GitHub-hosted projects to deliver malicious npm package dependencies to unsuspecting developers