Full Report
Who's attacking your vendors? Read about the six main supply chain attack groups who are driving SaaS, open-source, and MSP compromise in 2026. Learn how npm supply chain attacks threaten your security today, based on threat intelligence collected by Group-IB.
Analysis Summary
Based on the threat intelligence provided by Group-IB regarding supply chain trends and the specific actor highlighted in recent npm-related campaigns, the following summary has been structured.
# Threat Actor: Lazarus Group (Sub-group: Jade Sleet / TraderTraitor)
## Attribution & Identity
* **Actor Identification:** Lazarus Group (State-sponsored actor linked to the Democratic People’s Republic of Korea - DPRK).
* **Aliases:** Jade Sleet, TraderTraitor, UNC4899, APT38.
* **Known Associations:** Often operates via specialized units focusing on financial gain and cryptocurrency, identified by Group-IB and other partners as a primary driver of high-impact open-source supply chain attacks.
## Activity Summary
* **Recent Campaigns:** Extensive targeting of the **npm ecosystem** (open-source JavaScript registry) throughout 2024 and 2025. The actor has been observed publishing malicious packages that masquerade as legitimate development tools or media players.
* **Social Engineering:** Conducting "recruitment" campaigns where they approach developers on platforms like LinkedIn or GitHub, inviting them to collaborate on projects that require downloading malicious repositories or dependencies.
## Tactics, Techniques & Procedures
* **Supply Chain Poisoning:** Injecting malicious code into npm packages to compromise downstream developers and their organizations.
* **Dependency Confusion:** Leveraging internal naming conventions to force systems to download malicious public packages instead of private ones.
* **Typosquatting:** Registering package names very similar to popular libraries (e.g., `react-utility-tool` instead of a legitimate variant).
* **Malicious OAuth & API Key Theft:** Focused on stealing session tokens and credentials to move laterally into cloud environments.
* **MITRE ATT&CK IDs:**
* T1195.001 (Supply Chain Compromise: Compromise Software Dependencies and Development Tools)
* T1566.002 (Phishing: Spearphishing Link/Social Engineering)
* T1550.017 (Use Alternate Authentication Material: Web Session Cookie/OAuth)
## Targeting
* **Sectors:** Cryptocurrency services, Financial Services, IT/Software Providers, and Defense.
* **Geography:** Global (with significant focus on South Korea, USA, Singapore, and Japan).
* **Victims:** Individual developers, DevOps engineers, and downstream SaaS platforms integrated via npm.
## Tools & Infrastructure
* **Malware:** **TraderTraitor** (a family of malicious binaries written in Rust or JavaScript designed to exfiltrate system info and download second-stage payloads).
* **Infrastructure:**
* Malicious npm registry entries.
* C2 Domains (Defanged): `cryptoprice-api[.]com`, `trading-platform[.]io`, `npm-update[.]org`.
* IPs (Defanged): `172[.]67[.]162[.]206`.
## Implications
Lazarus has shifted from direct hacking of financial institutions to "industrialized" supply chain compromise. By targeting the software development lifecycle (SDLC), a single successful package injection allows them to bypass traditional perimeter defenses and gain access to thousands of enterprise environments simultaneously. This represents a strategic shift toward scalable, high-stealth operations.
## Mitigations
* **Software Bill of Materials (SBOM):** Maintain a live inventory of all third-party and open-source dependencies.
* **Lockfile Pinning:** Use `package-lock.json` or `yarn.lock` to ensure specific versions of dependencies are used and verified by hashes.
* **Integrity Verification:** Implement runtime dependency scanning to detect if a package has been altered post-installation.
* **Credential Hygiene:** Strictly monitor and rotate OAuth tokens, API keys, and service accounts, especially those with access to production codebases.
* **Behavioral Monitoring:** Deploy tools to detect abnormal outbound traffic from build servers or developer workstations to unknown C2 domains.