Full Report
North Korean threat actors planted 67 malicious packages in the Node Package Manager (npm) online repository to deliver a new malware loader called XORIndex to developer systems. [...]
Analysis Summary
# Threat Actor: XORIndex Operators (Attributed to North Korea)
## Attribution & Identity
* **Attribution:** Associated with **North Korean hackers**.
* **Known Aliases/Groups:** The activity is linked to operators who also utilize malware families like **Crimson Interview** (referred to as "Contagious Interview threat actors" in the quote) and previously deployed malware variants such as **BeaverTail** and **InvisibleFerret**.
## Activity Summary
The threat actors are actively compromising supply chains by hiding the **XORIndex** malware within malicious **npm packages**. They infected at least **67 malicious npm packages** in the latest campaign discovered. When npm removes the infected packages, the actors rapidly return using different npm accounts and package names, demonstrating persistence.
## Tactics, Techniques & Procedures
* **Supply Chain Compromise:** Utilizing the npm ecosystem to distribute malware via malicious packages.
* **Evasion:** Blending old and new tools with subtle modifications to evade detection.
* **Persistence/Repetitive Action:** Rotating through new npm maintainer aliases after prior infections are cleaned up by repository hosts.
* **Loader Re-use:** Reusing existing loaders like **HexEval Loader**.
* **Payload Capability:** The installed malware allows actors to establish persistence, command and control, exfiltrate data, and download further payloads.
## Targeting
* **Sectors:** The description focuses heavily on targeting the **software development/dependency chain**, specifically through the **npm repository**. Industries relying heavily on these open-source dependencies are implicitly targeted.
* **Geography:** Not explicitly mentioned, but attributed to **North Korean actors**.
* **Victims:** Developers and organizations consuming packages from the npm repository.
## Tools & Infrastructure
* **Malware Families Used:**
* **XORIndex** (newly observed variant, delivered via loaders, e.g., XORIndex Loader).
* **BeaverTail** (reused malware family).
* **InvisibleFerret** (reused malware family).
* **Infrastructure:**
* **Loaders:** HexEval Loader.
* **Distribution Method:** Malicious npm packages (approximately 67 identified in the latest campaign).
## Implications
This activity highlights the persistent, high-volume threat posed by North Korean actors targeting open-source supply chains, specifically the npm registry. Their speed in re-infecting the ecosystem after remediation, coupled with their methodical rotation of aliases, signals a long-term strategic effort to maintain persistent access points within the global software infrastructure.
## Mitigations
* **Supply Chain Scrutiny:** Thoroughly vet all sourced npm packages.
* **Trust Verification:** Only trust well-known projects and publishers with proven track records.
* **Anomaly Detection:** Scrutinize recent repository activity for signs of automation or rapid creation of similar packages.
* **Code Examination:** Examine the source code of new libraries for obfuscation techniques.
* **Isolation:** Execute newly incorporated libraries in isolated environments (sandboxing) to evaluate safety before integration.
* **Typo-squatting Awareness:** Be vigilant against typosquatting decoys designed to trick users into installing malicious packages.