TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

The Hacker News

New Wave of DPRK Attacks Uses AI-Inserted npm Malware, Fake Firms, and RATs

[email protected] (The Hacker News) · 6 days ago · Read original ↗

ATT&CK techniques detected

24 predictions
T1195.001Compromise Software Dependencies and Development Tools
99%
“organizations related to blockchain companies that have been active on github since june 2025, " reversinglabs security researcher karlo zanki said. " their purpose is to provide trustworthiness to fake job offerings and to host fake job interview tasks. " recent versions of the …”
T1195.001Compromise Software Dependencies and Development Tools
98%
“new wave of dprk attacks uses ai - inserted npm malware, fake firms, and rats cybersecurity researchers have discovered malicious code in an npm package after a malicious package as a dependency to the project by anthropic ' s claude opus large language model ( llm ). the package…”
T1195.001Compromise Software Dependencies and Development Tools
98%
“, causing the agent package to execute malicious code and give attackers access via leaked credentials to the victim ' s cryptocurrency wallets and funds. the attack adopts a phased approach, where the first - layer packages do not contain any malicious code, but import second - …”
T1195.001Compromise Software Dependencies and Development Tools
98%
“graphbase - js - graphlib - js the attack culminates with the deployment of a rat that can gather system information, enumerate files and directories, list running processes, create folders, rename files, delete files, and upload / download files. in recent weeks, a north korean …”
T1195.001Compromise Software Dependencies and Development Tools
97%
“the fraudulent it worker scam. " the new malware campaign [... ] involves a tainted package that was introduced in a feb. 28 commit to an autonomous trading agent, " reversinglabs researcher vladimir pezo said in a report shared with the hacker news. " the commit was co - authore…”
T1195.001Compromise Software Dependencies and Development Tools
96%
“coding tests to deliver malicious npm packages to their systems. the campaign plays out like this : the hackers employ social engineering ploys on job - seeking platforms and social networks to trick prospective targets into downloading github - hosted projects as part of an asse…”
T1195.001Compromise Software Dependencies and Development Tools
93%
“flowlimit, " and " chai - extensions - extras. " a third method has employed a matryoshka doll approach as part of a campaign dubbed contagious trader. the attack begins with the download of a benign wrapper package ( e. g., " bjs - biginteger " ), which then proceeds to download…”
T1195.001Compromise Software Dependencies and Development Tools
92%
“small number of the dependencies are malicious packages from the second layer. " the threat actors employ various techniques to help the rogue packages escape detection. these include creating a malicious version of the functions already present in the listed popular packages. an…”
T1587Develop Capabilities
89%
“new wave of dprk attacks uses ai - inserted npm malware, fake firms, and rats cybersecurity researchers have discovered malicious code in an npm package after a malicious package as a dependency to the project by anthropic ' s claude opus large language model ( llm ). the package…”
T1204.005Malicious Library
87%
“small number of the dependencies are malicious packages from the second layer. " the threat actors employ various techniques to help the rogue packages escape detection. these include creating a malicious version of the functions already present in the listed popular packages. an…”
T1587Develop Capabilities
78%
“, causing the agent package to execute malicious code and give attackers access via leaked credentials to the victim ' s cryptocurrency wallets and funds. the attack adopts a phased approach, where the first - layer packages do not contain any malicious code, but import second - …”
T1195.002Compromise Software Supply Chain
78%
“the fraudulent it worker scam. " the new malware campaign [... ] involves a tainted package that was introduced in a feb. 28 commit to an autonomous trading agent, " reversinglabs researcher vladimir pezo said in a report shared with the hacker news. " the commit was co - authore…”
T1587Develop Capabilities
77%
“rust. the evolution of the malware from a simple infostealer to a specialized multi - platform harvester targeting windows, linux, and macos capable of dropping ssh backdoors and gathering entire projects demonstrates north korean threat actors ' continued targeting of the open -…”
T1587Develop Capabilities
74%
“coding tests to deliver malicious npm packages to their systems. the campaign plays out like this : the hackers employ social engineering ploys on job - seeking platforms and social networks to trick prospective targets into downloading github - hosted projects as part of an asse…”
T1204.005Malicious Library
70%
“the fraudulent it worker scam. " the new malware campaign [... ] involves a tainted package that was introduced in a feb. 28 commit to an autonomous trading agent, " reversinglabs researcher vladimir pezo said in a report shared with the hacker news. " the commit was co - authore…”
T1195.001Compromise Software Dependencies and Development Tools
68%
“rust. the evolution of the malware from a simple infostealer to a specialized multi - platform harvester targeting windows, linux, and macos capable of dropping ssh backdoors and gathering entire projects demonstrates north korean threat actors ' continued targeting of the open -…”
T1587Develop Capabilities
61%
“organizations related to blockchain companies that have been active on github since june 2025, " reversinglabs security researcher karlo zanki said. " their purpose is to provide trustworthiness to fake job offerings and to host fake job interview tasks. " recent versions of the …”
T1587Develop Capabilities
56%
“graphbase - js - graphlib - js the attack culminates with the deployment of a rat that can gather system information, enumerate files and directories, list running processes, create folders, rename files, delete files, and upload / download files. in recent weeks, a north korean …”
T1587Develop Capabilities
56%
“the fraudulent it worker scam. " the new malware campaign [... ] involves a tainted package that was introduced in a feb. 28 commit to an autonomous trading agent, " reversinglabs researcher vladimir pezo said in a report shared with the hacker news. " the commit was co - authore…”
T1219Remote Access Tools
51%
“via socket. io, with capabilities including browser credential theft, crypto wallet extraction, screenshot capture, clipboard monitoring, keylogging, and remote mouse / keyboard control, " safedep noted this month. interestingly, the use of legitimate packages like " socket. io -…”
T1587Develop Capabilities
50%
“flowlimit, " and " chai - extensions - extras. " a third method has employed a matryoshka doll approach as part of a campaign dubbed contagious trader. the attack begins with the download of a benign wrapper package ( e. g., " bjs - biginteger " ), which then proceeds to download…”
T1587Develop Capabilities
46%
“small number of the dependencies are malicious packages from the second layer. " the threat actors employ various techniques to help the rogue packages escape detection. these include creating a malicious version of the functions already present in the listed popular packages. an…”
T1204.005Malicious Library
36%
“new wave of dprk attacks uses ai - inserted npm malware, fake firms, and rats cybersecurity researchers have discovered malicious code in an npm package after a malicious package as a dependency to the project by anthropic ' s claude opus large language model ( llm ). the package…”
T1588.002Tool
32%
“a lazarus group sub - cluster known as bluenoroff, citing infrastructure overlaps and the rat ' s similarities with nukesped. " the threat actors ' use of advanced techniques and tactics, as well as an astonishing level of campaign preparation ( setting up a florida llc ) and the…”

Summary

Cybersecurity researchers have discovered malicious code in an npm package after a malicious package as a dependency to the project by Anthropic's Claude Opus large language model (LLM). The package in question is "@validate-sdk/v2," which is listed on npm as a utility software development kit (SDK) for hashing, validation, encoding/decoding, and secure random generation. However, its real