Suspected DPRK npm supply chain attack: archetype-index-sdk ships obfuscated loader with credential harvesting
cyb3rops · x · 2026-11-09
Nextron Research's artifact pipeline flagged [email protected], the latest npm package tied to a suspected DPRK cluster.
- Importing auto-loads two obfuscated components disguised as telemetry-info.mjs and dist/runtime-matrix.mjs
- The loader fingerprints the host and exfiltrates data to a known C2 at cdn[.]node-js[.]dev
- It can drop a Base64-encoded second stage as helper.cjs and launch it as a detached Node.js process
Pivoting revealed related packages dating back to October 25 (birch-css-utils, character-ai-sdk, mocha-ui-themes, etc.), most removed from npm — though [email protected] remains live. They share obfuscated payloads and identical cross-platform VM-detection binaries, with credential harvesting, AWS/Bedrock and invoice reconnaissance, plus cron, SSH-key and curl PATH-shim persistence. The campaign keeps rotating filenames and delivery mechanics while retaining the same C2 infrastructure.
More from coding & agent
- GitNexus Turns Any GitHub Repo Into an In-Browser Interactive Knowledge Graph, Fully Open-Source — JafarNajafov · 2026-11-09
- Better Paseo plugin puts every AI agent on one task board across phone, iPad and desktop — intellectronica · 2026-11-09
- Alibaba open-sources Zvec, an in-process vector DB that's already at 16.2k GitHub stars — bigaiguy · 2026-11-09
- Keep, the save-as-Markdown tool for AI agents, launches on iOS after 2-month App Store review — iannuttall · 2026-11-09
- Claude Code cross-session messaging in parallel worktrees: two limits and a hardening config — Independent-Sir3234 · 2026-11-09
- Open-source RAG eval tool ships recall, faithfulness and cost metrics with no API key — infrixo · 2026-11-09