More DPRK packages, clearly targeting developers by package name.
What's interesting here is the dropper isn't in index.js like the others. This one pulls from a gist, and inside that gist is the same dropper I've mentioned in other posts.
They then pull in the malicious package as a require. So the other packages don't appear malicious on their own, they're doing normal things and just pulling in the malicious one. This is interesting.
This is something I think is expected as the crackdown on lifecycle hooks begins with npm v12. With allowScripts defaulting off, preinstall/postinstall won't fire on their own anymore, so it makes sense to move execution into the require chain instead.
One malicious package, then require it in the others. It runs when the code actually gets used instead of at install.
Worth watching if this becomes the usual pattern once v12 ships in July.
Five more packages appear tied to the same DPRK loader/RAT cluster, with possible Famous Chollima overlap based on VT community reporting for the shared C2 IP.
Same obfuscated JS, C2 IP, /api/service/ fetch, 0001.dat drop, and Node execution path.
Packages below.