A new wave of supply chain attacks is hitting JavaScript and Web3 developers through poisoned npm packages, fake GitHub repos, and Vercel-hosted payloads. Investigators have logged nearly two hundred malicious packages tied to the OtterCookie malware family since October 2025. The operation blends social engineering, typosquatting, and continuous payload rotation across cloud infrastructure. The campaign shows how threat actors now target everyday development workflows rather than traditional phishing paths.
Relevant Source (Socket Threat Research): Inside the GitHub Infrastructure Powering North Korea’s Contagious Interview npm Attacks
Socket’s research details how North Korean actors use malicious npm packages, GitHub repos, and Vercel-hosted payloads in the Contagious Interview campaign to deploy OtterCookie against modern developer toolchains.
Quick Facts
- Nearly 200 malicious npm packages linked to OtterCookie
- Over 31,000 downloads recorded in the recent campaign
- Fake GitHub profiles host staged payload repos
- Vercel endpoints deliver rotating JavaScript malware
- OtterCookie functions as an infostealer and remote access trojan
- Targets Windows, macOS, Linux, Chrome, Brave, and 40+ crypto wallets
Behind The Attack
North Korean state-backed operators launched a long-running campaign known as Contagious Interview. They built typosquatted npm packages, fabricated GitHub portfolios, and used Vercel to host malicious payloads. This setup integrates seamlessly into normal development activity and tricks developers who trust npm’s postinstall scripts.
- Typosquatted npm libraries impersonate popular packages
- Fake GitHub repos mimic legitimate Web3 projects
- Vercel endpoints deliver updated JavaScript payloads
A coordinated approach across multiple platforms makes the campaign effective and hard to detect. Attackers hide behind common developer patterns while rotating their infrastructure to stay ahead of security scans.
Relevant Source (Hunted Labs): How North Korea is Exploiting GitHub to Infiltrate Software Supply Chains
Hunted Labs details North Korea’s use of fake developer GitHub accounts and supply chain tactics to insert malicious code into trusted projects at scale.
Why It Matters
The incident highlights a growing threat to software supply chains. Attackers no longer need to compromise a company directly when they can hijack the tools developers use every day. The OtterCookie malware abuses Node.js execution privileges to gain deep access to local machines.
- Targets all major operating systems
- Evades detection through environment checks
- Steals browser credentials and crypto wallet data
- Captures keystrokes and screenshots
- Maintains persistent access with scheduled tasks
These capabilities give attackers broad visibility into developer systems. Stronger package vetting and runtime monitoring are now essential for anyone building modern software.
Relevant Source (CISA): Widespread Supply Chain Compromise Impacting npm Ecosystem
CISA’s alert describes a large-scale npm software supply chain compromise and explains how malicious packages can threaten the integrity of developer tools and environments.
Relevant Source (Google Threat Intelligence): DPRK Adopts EtherHiding: Nation-State Malware Hiding in Smart Contracts
Google’s research shows how North Korean operators use advanced malware techniques to steal cryptocurrency and persist in victim environments, underscoring the risks from developer-focused campaigns like OtterCookie.
What To Do Now
Developers and organizations need immediate defensive steps to reduce exposure to this campaign. The attack relies heavily on trust in package ecosystems, so verification and monitoring should be standard practice.
- Audit recent npm installs for unknown or suspicious libraries
- Block suspicious domains and Vercel endpoints tied to the campaign
- Enable endpoint protection that monitors Node.js child processes
- Use package signing and lockfiles in all active projects
- Rotate browser credentials and crypto wallet keys if any compromise is suspected
Taking quick action lowers the chance of long-term persistence and limits the damage from stolen credentials or wallet data.
Relevant Source (CISA): Defending Against Software Supply Chain Attacks
CISA outlines concrete steps for organizations to identify and mitigate software supply chain risks, including dependency audits, monitoring, and credential hygiene.
Relevant Source (Endor Labs): How to Defend Against NPM Software Supply Chain Attacks
Endor Labs provides practical guidance for developers and security teams on hardening npm environments, reviewing packages, and limiting the blast radius of compromised dependencies.
The Big Picture
Global threat groups now take advantage of the open ecosystem around npm, GitHub, and cloud hosting providers. The convenience that modern development platforms offer also creates opportunities for malware distribution with little friction. Typosquatting, automated installs, and cloud-hosted scripts make it simple for attackers to slip into the workflow of fast-moving teams.
OtterCookie represents a shift toward cross-platform developer-focused malware. It blends remote access, credential theft, and adaptive payload delivery into a single toolkit. The campaign reinforces the need for stronger supply chain protections across the entire software lifecycle, not just at the production stage.
Conclusion
North Korean operators leveraged trusted development tools to spread OtterCookie with surprisingly high efficiency. Developers who rely on npm and GitHub should tighten their dependency controls and treat installation scripts as potential attack vectors. A careful review of recent project activity and ongoing endpoint monitoring can provide early warning signs before sensitive data leaves the system.
FAQ
What makes these npm packages dangerous?
They run postinstall scripts that automatically execute attacker-supplied JavaScript.
How many malicious packages have been identified?
Researchers found at least 197 new npm packages tied to this campaign.
Does OtterCookie work on macOS and Linux?
Yes. The malware supports Windows, macOS, and Linux environments.
What data does the malware target?
Browser credentials, crypto wallet data, screenshots, clipboard content, and keystrokes.
How are the payloads delivered?
Through attacker-controlled GitHub repos and Vercel endpoints serving rotating JavaScript code.
How JENI Strengthens Developer Security
JENI provides system hardening and performance tools built for users who want a cleaner and safer computing environment. Threats like OtterCookie exploit weak points in everyday workflows, so a stable and well-maintained system becomes an important layer of protection. JENI helps reduce the attack surface without disrupting how developers build, test, and ship software.
Key Advantages
- Identifies unusual background processes that often signal hidden loaders
- Improves system stability so malicious scripts struggle to persist
- Cleans remnants of temporary or abandoned development packages that attackers target
A well-optimized system gives developers a better chance of spotting suspicious behavior before damage occurs. JENI supports this by keeping machines responsive and free from unnecessary clutter that can hide malicious activity. Strong local hygiene pairs well with good package management and monitoring habits. Together these practices help developers stay ahead of the tactics used in modern supply chain attacks.
