Cybersecurity researchers have uncovered an upgraded version of the Contagious Interview, attributed to North Korean hackers. At its heart are 26 malicious packages published on the npm registry, disguised as useful tools for developers. Behind the seemingly innocent code, however, was a multi-layered attack chain aimed at collecting credentials and installing a remote access trojan.
The activity is being tracked by Socket and researcher Kieran Miyamoto, under the name StegaBin, highlighting the use of steganography to hide the actual command-and-control (C2) infrastructure.
Malicious npm packages
- argonist@0.41.0
- bcryptance@6.5.2
- bee-quarl@2.1.2
- bubble-core@6.26.2
- corstoken@2.14.7
- daytonjs@1.11.20
- ether-lint@5.9.4
- expressjs-lint@5.3.2
- fastify-lint@5.8.0
- formmiderable@3.5.7
- hapi-lint@19.1.2
- iosysredis@5.13.2
- jslint-config@10.22.2
- jsnwebapptoken@8.40.2
- kafkajs-lint@2.21.3
- loadash-lint@4.17.24
- mqttoken@5.40.2
- prism-lint@7.4.2
- promanage@6.0.21
- sequelization@6.40.2
- typoriem@0.4.17
- undicy-lint@7.23.1
- uuindex@13.1.0
- vitetest-lint@4.1.21
- windowston@3.19.2
- zoddle@4.4.2
Steganography via Pastebin and C2 in Vercel
The most worrying aspect of the new campaign is the technique of hiding C2 addresses within seemingly innocent texts on Pastebin. The packages included installation scripts (install.js) that were automatically executed during npm install and triggered the malicious payload from the vendor/scrypt-js/version.js file.
See also: Compromised dYdX packages on npm and PyPI distribute wallet thieves and RATs
The loader acted as a steganography decoder: it stripped Unicode zero-width characters, read a 5-digit length marker , and extracted characters at specific, evenly spaced positions within the text. The result was a list of hidden C2 domains, separated by the symbol ||| and terminated with ===END===. The C2 infrastructure was hosted on Vercel, with 31 different deployments acting as intermediate distribution nodes.
Choosing legitimate cloud services and popular text publishing platforms enhances the campaign's resilience and makes it difficult for both automated detection and human verification.
Multiplatform attack with RAT and credential stealers
Once the C2 domains were decoded, the packets retrieved payloads tailored for Windows, macOS, and Linux. In one case, the ext-checkdin.vercel[.]app domain provided a shell script that resulted in the RAT installation. The trojan contacted IP address 103.106.67[.]63 to receive commands, allowing directory changes and shell command execution.
Malicious modules
The malicious suite included nine sub-modules: “vs” targeted Microsoft Visual Studio Code, creating malicious tasks.json that were triggered with runOn: “folderOpen”, ensuring persistence every time the developer opened the project. “clip” acted as a keylogger and clipboard stealer with periodic data extraction. “bro” stole stored credentials from browsers, while “j” targeted cryptocurrency wallets and extensions in Chrome, Firefox, Edge and Brave, including MetaMask and other popular solutions. “z” controlled the file system and stole files , and “n” acted as a RAT to give the attacker the ability to remotely control the infected host in real time via a persistent WebSocket connection to 103.106.67[.]63:1247. Then, he could proceed to export data of interest via FTP.
See also: Lazarus campaign plants malicious npm and PyPI packages
At the same time, the “ truffle ” module downloaded the legitimate TruffleHog secrets scanner from GitHub to detect secrets in repositories, while “ git ” collected SSH keys and data from .ssh folders. Finally, “ sched ”, which is the same as “vendor/scrypt-js/version.js”, was used as a persistence mechanism .
Tactical evolution and multiple infrastructures
Unlike previous waves of Contagious Interview that relied on simpler payloads and Bitbucket hosting, the new version demonstrates techniques detection evasion. The use of steganography and multi-stage routing via Vercel suggest a strategy with an emphasis on sustainability and resilience.
What does this mean for the developer community?
The case highlights the growing risk of attacks in the software supply chain. Developers often trust popular packages without thorough verification, especially when they declare as dependencies the authentic libraries they mimic.
See also: From Ransomware to Permanent Access: The Rise of Digital Parasites
Defense requires a multi-layered approach: checking package integrity, using lockfiles, monitoring unusual post-install scripts, and adopting SCA (Software Composition Analysis) solutions. In an environment where the development chain is now a primary target of state-sponsored groups, code security is not just a technical issue, but a strategic necessity.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
