North Korean threat actors, specifically the FAMOUS CHOLLIMA group (linked to Lazarus), published 26 malicious npm packages in late February 2026 as part of the ongoing “Contagious Interview”campaign.

This specific wave, dubbed StegaBin, targets software developers with a sophisticated, multi-stage infection chain:

• Malicious Packages: The 26 packages masquerade as legitimate developer tools and were published between February 25 and 26 using individual throwaway accounts.
• Steganographic C2 Extraction: The loader extracts command-and-control (C2) URLs hidden within three Pastebin posts. These posts appear as innocuous computer science essays, but contain steganographically encoded characters that reveal infrastructure addresses.
• Infrastructure: The campaign leverages Vercelfor its C2 infrastructure across 31 deployments to blend in with legitimate developer traffic.
• Cross-Platform RAT: The final payload is a cross-platform Remote Access Trojan (RAT) that connects to a hardcoded IP and deploys 9 infostealer modules.
• Capabilities: The malware targets highly sensitive developer data, including VSCode persistence, clipboard content, browser credentials, TruffleHog secret scanning results, Git repositories, and SSH keys.

Security researchers at Socket and independent experts identified these packages, noting they share a single malicious file located at vendor/scrypt-js/version.js. This campaign follows a long-standing pattern where North Korean actors use fake job interviews and test assignments to trick developers into installing compromised dependencies.