N. Korean Hackers Spread 1,700 Malicious Packages Across npm, PyPI, Go, Rust

The North Korea-linked Contagious Interview campaign has expanded to five open-source ecosystems — npm, PyPI, Go, Rust, and PHP (Packagist) — publishing over 1,700 malicious packages since January 2025. These packages impersonate legitimate developer tooling and act as malware loaders that fetch second-stage payloads with infostealer and RAT capabilities, targeting browser data, password managers, and crypto wallets. Notably, malicious code is not triggered at install time but embedded within seemingly legitimate functions to evade detection. A separate but related campaign by UNC1069 (overlapping with BlueNoroff/Sapphire Sleet) poisoned the Axios npm package and uses social engineering via Telegram, LinkedIn, and Slack with fake Zoom/Teams meeting links to deliver implants that remain dormant post-compromise to maximize operational window.